INSERT not working? - php

Question

I have a simple INSERT that is not working. Can you php/mySQL experts do a quick scan. When I process the code, it does say "successful" i.e. "1 record added'" and "successfully created directory" - but there is NO new directory I see on the server AND it adds a record in the db but all the fields are empty?
include("_inc/config.php");
$sql = "INSERT INTO members (id, active, namefirst, namelast, email, username, password, birthyear, gender, country, postalcode, education, dimension, referredby, pic_profile, pic_background, origination, customerid) VALUES ('','$_POST[active]','$_POST[namefirst]','$_POST[namelast]','$_POST[email]','$_POST[username]','$_POST[password]','$_POST[birthyear]','$_POST[gender]','$_POST[country]','$_POST[postalcode]','$_POST[education]','$_POST[dimension]','$_POST[referredby]','$_POST[pic_profile]','$_POST[pic_background]','$_POST[origination]','$_POST[customerid]')";
$newdir=$_POST['username'];
if (!mysql_query($sql,$con)){
die('Error: ' . mysql_error());
}
echo "1 record added";
echo "<br><br>";
// Build Directories
mkdir("../".$newdir,0777);
chmod("../".$newdir,0777);
mkdir("../".$newdir."/assets/",0777);
chmod("../".$newdir."/assets/",0777);
if("../".mkdir($newdir, 0777, true))
{
echo 'successfully created directory';
}
else
{
die('problem creating directory');
}
mysql_close($con)
FORM
<form role="form" name="form" action="mpx_signup_process.php">
<div class="form-group">
<label for="nameandemail">Name and Email</label>
<input name="namefirst" class="form-control" placeholder="First Name">
</div>
<div class="form-group">
<input name="namelast" class="form-control" placeholder="Last Name">
</div>
<div class="form-group">
<input name="email" type="email" class="form-control" id="exampleInputEmail1" placeholder="Enter email">
</div>
<div class="form-group"><hr></div>
<div class="form-group">
<label for="accountinfo">Account Information</label>
<input name="username" class="form-control" id="exampleInputPassword1" placeholder="User Name">
</div>
<div class="form-group">
<input name="password" class="form-control" id="exampleInputPassword1" placeholder="Password">
</div>
<div class="form-group">
<input name="password" class="form-control" id="exampleInputPassword1" placeholder="Password Repeat">
</div>
<hr />
<div class="form-group">
<label for="personalinfo">Personal Information</label>
<h3>Country</h3>
<select name="country" class="form-control">
<option value="USA">United States</option>
<option value="UMI">United States Minor Outlying Islands</option>
<option value="USA">- - - - - -</option>
<option value="ALA">Åland Islands</option>
<option value="ALB">Albania</option>
<option value="DZA">Algeria</option>
<option value="ASM">American Samoa</option>
</select>
</div>
<div class="form-group">
<label for="referredby">Postal Code</label>
<input name="postalcode" class="form-control" id="exampleInputPostalCode" placeholder="Postal Code">
</div>
<div class="form-group">
<label for="gender">Gender</label>
<div class="radio">
<label>
<input type="radio" name="gender" id="optionsRadios4" value="01">
Male
</label>
<label>
<input type="radio" name="gender" id="optionsRadios5" value="02">
Female
</label>
<label>
<input type="radio" name="gender" id="optionsRadios6" value="03">
Other
</label>
</div>
</div>
<div class="form-group">
<label for="dateofbirth">Date of Birth</label>
<select name="birthyear" class="form-control">
<?php
for($i = 2010 ; $i > 1920; $i--){
echo "<option value=".$i.">$i</option>";
}
?>
</select>
</div>
<div class="form-group">
<label for="education">Education</label>
<select name="education" class="form-control">
<option value="01">Pre High School</option>
<option value="02">High School</option>
<option value="03">Some College</option>
<option value="04">College Graduate</option>
<option value="05">Graduate Degree</option>
</select>
</div>
<div class="form-group">
<label for="referredby">Referred By</label>
<input name="referredby" class="form-control" id="exampleInputreferredby" placeholder="Referred By">
</div>
<input type="hidden" name="active" value="no">
<input type="hidden" name="dimension" value="00">
<input type="hidden" name="pic_profile" value="mpx_profilepic.jpg">
<input type="hidden" name="pic_background" value="mpx_bsckgroundpic.jpg">
<?php
$date = date('l jS \of F Y h:i:s A');
?>
<input type="hidden" name="origination" value="<?php echo $date; ?>">
<button type="submit" class="btn btn-default">Submit</button>
</form>

Answer 1

In the form, add a method="POST"
<form role="form" name="form" method="POST" action="mpx_signup_process.php">
Because $_POST["username"] is empty the new directory name is empty thus the reason for not creating it I assume.
I would also suggest adding a check to determine if the record was infact inserted. The code above will ALWAYS return "1 record added" which is incorrect. Use something similar to mysql_rows_affected but using mysqli or PDO rather.
if(mysql_affected_rows() > 0)
{
echo "1 record added";
echo "<br><br>";
// Build Directories
mkdir("../".$newdir,0777);
chmod("../".$newdir,0777);
mkdir("../".$newdir."/assets/",0777);
chmod("../".$newdir."/assets/",0777);
}
else
{
echo "No records added";
}

Answer 2

Sure it will always "successfully created directory"!
Please look,
if("../".mkdir($newdir, 0777, true))
When mkdir eval to false (fail), you'll get
if("../" . false)
// or
if("../false") // maybe
// or just
if("../") // maybe, I'm unsure.
and it's non empty string, BTW, it always eval to true ensuring you hit the
echo 'successfully created directory';

Answer 3

In $sql you're not escaping the string properly
the php post variables in $sql are as $_POST[namelast], $_POST[email], etc, whereas it should be $_POST['namelast'], $_POST['email'], etc.