submit form data to database table - php

Question

I get problem in inserting data to database table. I have checked everything from table fields to the form fields. Everything is ok and even print_r prints the result but data is not inserted to database. it returns empty result set.
my form code
<?php include('header.php'); ?>
<div class="page container">
<div class="row col-12 register-page">
<form class="form-horizontal" role="form" action="register-process.php" method="post">
<div class="form-group">
<label for="firstname" class="col-sm-2 control-label">First Name</label>
<div class="col-sm-10">
<input type="text" class="form-control" id="firstname" name="firstname"
placeholder="Enter First Name">
</div>
</div>
<div class="form-group">
<label for="lastname" class="col-sm-2 control-label">Last Name</label>
<div class="col-sm-10">
<input type="text" class="form-control" id="lastname" name="lastname"
placeholder="Enter Last Name">
</div>
</div>
<div class="form-group">
<label for="email" class="col-sm-2 control-label">Email</label>
<div class="col-sm-10">
<input type="text" class="form-control" id="email" name="email"
placeholder="Enter Your Email">
</div>
</div>
<div class="form-group">
<label for="password" class="col-sm-2 control-label">Password</label>
<div class="col-sm-10">
<input type="password" class="form-control" id="password" name="password"
placeholder="Enter your password">
</div>
</div>
<div class="form-group">
<label for="confirm-password" class="col-sm-2 control-label">Confirm Password</label>
<div class="col-sm-10">
<input type="password" class="form-control" id="cpassword" name="cpassword"
placeholder="Confirm password">
</div>
</div>
<div class="form-group">
<label for="birth-year" class="col-sm-2 control-label">Birth Year</label>
<div class="col-sm-10">
<select id="year" class="birth-year" name="birth-year">
<?php
for($i = 1970; $i < date("Y")+1; $i++){
echo '<option value="'.$i.'">'.$i.'</option>';
}
?>
</select>
</div>
</div>
<div class="form-group">
<label for="gender" class="col-sm-2 control-label register-gender">Gender</label>
<div class="col-sm-10">
<select id="registration_gender" class="select-register " required="required" name="gender">
<option selected="selected" value="">Gender</option>
<option value="_UE_M">Male</option>
<option value="_UE_MRS">Female</option>
</select>
</div>
</div>
<div class="form-group form-action">
<div class="form-action">
<input type="submit" name="submit" class="btn btn-large btn-primary" value="Lets Get Started" >
</div>
</div>
</form>
</div>
</div>
and my register-process code
<div class="page container">
<div class="row col-12 register-page">
<?php
$fname = $_POST['firstname'];
$lname = $_POST['lastname'];
$email = $_POST['email'];
$password = md5($_POST['password']);
$cpassword = md5($_POST['cpassword']);
$birthyear = $_POST['birth-year'];
$gender = $_POST['gender'];
if($fname && $lname && $email && $password && $cpassword){
if($password == $cpassword){
include("config.php");
$insert = 'INSERT INTO users(firstname,lastname,email,password,birth-year,gender)
VALUES("'.$fname.'","'.$lname.'","'.$email.'","'.$password.'","'.$birthyear.'","'.$gender.'")';
mysql_query($insert);
echo "registered successfully";
}
else{
header("Location: register.php");
echo "your password do not match.";
}
}
else{
echo "complete the form please.";
header("Location: register.php");
}
?>
</div>
</div>

Answer 1

The line
if($fname && $lname && $email && $password && $cpassword){
is checking if these values are true, which they aren't. The PHP code around this will result in SQL injections as you're not validating the values entered in your form. Look at escaping SQL and also removing HTML entities.
Use the function isset() on your $_POST variables, this way you can validate the form was filled in correctly. Once you're happy the form is filled in correctly, SQL escape and removal of html entities into your local variables and then use these to insert into SQL.