Saving form input to a php variable? - php

Question

I am writing a PHP script to take the contents of a variable and insert it into my MYSQL database, it works well when I define the values, but using variables just gives a error, can any one tell me the correct way to save form input to a variable. (the form is in the same file as the sql script excluding the logins, so using $_POST doesn't work)
mysqli_query($connect,"INSERT INTO news (news)
VALUES ('$email')");
if(mysqli_affected_rows($connect) > 0){
echo $good;
else
echo $bad
}
form:
<div class="row">
<form class="col s12">
<div class="row">
<div class="input-field col s6">
<input placeholder="Placeholder" id="email" type="text"
<label for="news">news</label>
</div>

Answer 1

You're asking for a lot of issues with that script. Lets walk through all of them:
1) Setting form attributes
It is important to tell the browser how to send the form data to your server. Otherwise you'll end up having to rely on the superglobal $_REQUEST. As quoted from the official PHP website:
The variables in $_REQUEST are provided to the script via the GET,
POST, and COOKIE input mechanisms and therefore could be modified by
the remote user and cannot be trusted.
So instead you should add the method attribute to your form. You might want to add character encoding as well, just to be sure your script won't get confused when someone uses non utf-8 characters:
<form method="POST" action="" accept-charset="utf-8">
2) A way to access your POST data
To be able to actually do something with POST data, you need a way to access it. This is where the name attribute comes into play:
<input placeholder="Placeholder" id="email" type="text" name="email" />
The superglobal $_POST will now be able to access the value of that input field using the name attributes value as a key: $_POST['email']. This will only work after the form is sent though.
3) Submit your form
You cannot magicly expect your server to have all the form data filled in by your website visitor. You need to submit it first:
<input type="submit" value="Register email" />
This will become a button with the text you've setup in the value attribute. When the visitor clicks on it, your form data will be submit to your server.
So your entire form should look like this:
<form method="POST" action="" accept-charset="utf-8">
<input placeholder="Placeholder" id="email" type="text" name="email" />
<input type="submit" value="Register email" />
</form>
4) Setting up PHP
Before we start working with the POST data, we need to be sure the user is giving us data:
if(isset($_POST['email']) && !empty($_POST['email'])){
//...
}
This will verify that $_POST['email'] exists and also makes sure it isn't empty.
5) Securely handling user data: Prepared Statements
One of the first things you learn as a developer is to never ever trust user data. Inputting data into a database submitted by a user without verifying it, is asking for a lot of trouble. Especially SQL Injection.
Using MySQLi Prepared Statements, you can protect yourself against this:
//$link will be the connection to your database
//For example: $link = mysqli_connect("localhost", "db_user", "db_pass", "db_name");
if ($stmt = mysqli_prepare($link, "INSERT INTO news (news) VALUES (?)")) {
/* bind parameters for markers */
mysqli_stmt_bind_param($stmt, "s", $_POST['email']);
/* execute query */
mysqli_stmt_execute($stmt);
/* close statement */
mysqli_stmt_close($stmt);
/* print success message */
echo "Email successfull registered!";
} else {
/* print errors */
printf("MySQL Error: %s\n", mysqli_error($link));
}
Wrapping it all together:
<?php
if(isset($_POST['email']) && !empty($_POST['email'])){
//$link will be the connection to your database
//For example: $link = mysqli_connect("localhost", "db_user", "db_pass", "db_name");
if ($stmt = mysqli_prepare($link, "INSERT INTO news (news) VALUES (?)")) {
/* bind parameters for markers */
mysqli_stmt_bind_param($stmt, "s", $_POST['email']);
/* execute query */
mysqli_stmt_execute($stmt);
/* close statement */
mysqli_stmt_close($stmt);
/* print success message */
echo "Email successfull registered!";
} else {
/* print errors */
printf("MySQL Error: %s\n", mysqli_error($link));
}
}
?>
<!-- Your HTML here -->
<div class="row">
<form class="col s12" method="POST" action="" accept-charset="utf-8">
<div class="row">
<div class="input-field col s6">
<input placeholder="Placeholder" id="email" type="text" name="email" />
<input type="submit" value="Register email" />
</div>
</div>
</form>
</div>
<!-- Your HTML here -->

Answer 2

Give your input a name
<input placeholder="Placeholder" id="email" name="email" type="text">
and get the value in php with
$email = $_REQUEST['email']; //to get both GET and POST methods.
then use the $email in your query