if isset Not Writing To Database - php

Question

I have an if isset statement that fires when my site receives approval from my merchant account api after a form is submitted. Everything seems to work except for the order details from the form getting written to my database. Here is the code for my form:
<form id="input-form" class="form-inline" action="" method="post">
<?php
if($error <> '') {
echo '<div class="alert alert-danger">',$error,'</div>';
}
?>
<div id="makepayment">
<div class="form-group">
<label for="order_fname">First Name</label>
<input class="form-control" style="width: 273px;" type="text" name="order_fname" id="order_fname" value="<?php echo $user['user_fname']; ?>" placeholder="First Name" />
</div>
<div class="form-group">
<label for="order_lname">Last Name</label>
<input class="form-control" style="width: 273px;" type="text" name="order_lname" id="order_lname" value="<?php echo $user['user_lname']; ?>" placeholder="Last Name" />
</div>
<div class="form-group">
<label for="order_phone">Primary Phone</label>
<input class="form-control" style="width: 273px;" type="text" name="order_phone" id="order_phone" value="<?php echo $user['user_phone']; ?>" placeholder="Phone Number" />
</div>
<div class="form-group">
<label for="order_cell">Cell Phone</label>
<input class="form-control" style="width: 273px;" type="text" name="order_cell" id="order_cell" value="<?php echo $user['user_cell']; ?>" placeholder="Cell Phone" />
</div>
<div class="form-group">
<label for="order_email">Email</label>
<input class="form-control" style="width: 273px;" type="text" name="order_email" id="order_email" value="<?php echo $user['user_email']; ?>" placeholder="Email Address" />
</div><br/>
<div class="clear"></div>
<div class="form-group" style="width:100% !important">
<label for="company_id">Property Information</label><br/>
<br/>
<input id="company_id" type="hidden" id="company_id" name="company_id" value="<?php echo $company['company_id']; ?>" />
<input id="company_name" type="hidden" id="company_name" name="company_name" value="<?php echo $company['company_name']; ?>" />
<div class="property">
<strong><?php echo $company['company_name']; ?></strong><br/>
<?php echo $company['company_street']; ?><br/>
<?php echo $company['company_city']; ?>, <?php echo $company['company_state']; ?> <?php echo $company['company_zip']; ?>
</div>
<div class="clear"></div>
</div><br/>
<div class="clear"></div>
<div class="form-group">
<label for="order_cc">Card Number</label>
<input class="form-control" type="text" name="ssl_card_number" id="ssl_card_number" style="width:100% !important" />
</div><br/>
<div class="clear"></div>
<div class="form-group">
<label for="order_code">Security Code</label>
<input class="form-control" style="width: 75px;" type="text" name="order_code" id="order_code" placeholder="ex:123" />
</div>
<div class="form-group">
<label for="order_customernumber">Customer Number</label>
<input class="form-control" type="text" style="width: 75px;" name="order_customernumber" id="order_customernumber" />
</div>
<div class="form-group">
<label for="order_invoicenumber">Invoice Number</label>
<input class="form-control" type="text" style="width: 75px;" name="order_invoicenumber" id="order_invoicenumber" />
</div>
<div class="form-group">
<label for="order_amount">Payment Amount</label>
$ <input class="form-control" type="text" style="width: 100px" name="ssl_amount" id="ssl_amount" />
</div>
<div class="form-group" style="width:100% !important">
<input class="btn btn-primary" type="submit" name="submit" value="Submit" />
</div>
</div>
</form>
Here is my if isset statement that fires if the api sends back an approval code. I know that part works because it does this action when I put in my card info and throws the proper error when I put in fake info.
if(isset($response['ssl_result_message']) && $response['ssl_result_message'] == "APPROVAL") {
//If transaction successful write to database
$userid = $session['user_id'];
$addOrderSQL = "
INSERT INTO orders (
user_id,
company_id,
order_fname,
order_lname,
order_phone,
order_cell,
order_email,
company_name,
order_customernumber,
order_invoicenumber,
order_amount
)
VALUES (
'$userid',
'$_POST[company_id]',
'$_POST[order_fname]',
'$_POST[order_lname]',
'$_POST[order_phone]',
'$_POST[order_cell]',
'$_POST[order_email]',
'$_POST[company_name]',
'$_POST[order_customernumber]',
'$_POST[order_invoicenumber]',
'$_POST[ssl_amount]'
)";
$firstname= $_POST['order_fname'];
$lastname = $_POST['order_lname'];
$invoice = $_POST['order_invoicenumber'];
$customernum = $_POST['order_customernumber'];
$property = $_POST['company_name'];
$ordertotal = $_POST['ssl_amount'];
/* -------------------------------------------------
Send Email to Administrator
------------------------------------------------- */
$to = "web#abcprintingink.com";
$subject = "Payment for Customer # ". $customernum;
$headers = "Content-type: text/html; charset=iso-8859-1\r\n";
$headers .= "From: webmaster#turfmastersct.com" . "\r\n" .
"Reply-To: webmaster#example.com" . "\r\n" .
"X-Mailer: PHP/" . phpversion();
$message = "<p>A customer has completed a payment. Here are the payment details:</p>
Customer Name: ". $firstname ." ". $lastname ."<br/>
Customer #: ". $customernum ."<br/>
Invoice #: ". $invoice ."<br/>
Property: ". $property ."<br/>
Payment Amount: $". $ordertotal;
// Send it.
mail($to, $subject, $message, $headers);
//once executed queries redirect user
header('Location: /payments/orders.php');
exit;
}
elseif(isset($response['errorCode'])) {
$error = 'Your credit card has been declined';
}
else {
$error = 'Failed to process your payment';
}
The form is communicating with the api, I get a response from it and I can see the payment details post to my demo account. The isset statement fires, I get the email that it sends and it redirects me to the orders.php page like it's supposed to. It just doesn't write to the database. You can see my form and you can see the fields I am writing to my database. All those fields exist in the database itself. Am I missing something here?

Answer 1

You never run the $addOrderSQL query.
See mysqli_query() to do this.