MySQL insert into fails on particular fields - php

Question

I believe that something in my code is stopping the PHP being inserted into the database which is strange because I use the same setup in other forms on the site which all parse successfully.
The thing which puzzles me the most is the fact that the form will go through successfully if only a username and password are specified, but when I try to add email (also a varchar) and a group (a 1 character integer), the form fails. I’ve added my code below so hopefully you would be able to help me find out what I'm doing wrong.
PHP:
// Connecting, selecting database
$link = mysql_connect('DOMAIN', 'USERNAME', 'PASSWORD');
if (!$link)
{ die('Could not connect: ' . mysql_error());
}
mysql_select_db('DATABASE') or die('Could not select database');
// Convert form values to variables
$name = $_POST['name'];
$pass = md5($_POST['pass']);
$iemail = $_POST['email'];
$email = addslashes($iemail);
$group = $_POST['group'];
$order = "INSERT INTO `users` (name,pass,email,group)
VALUES ('$name','$pass', '$email', '$group')";
$result = mysql_query($result);
if($result)
{
echo
header("Location: manageusers.php?result=success&name=$name");
die();
}
else
{
mysql_error();
}
mysql_close($link);
HTML:
<div class="panel panel-default">
<div class="panel-heading">
<h3 class="panel-title">Add User</h3>
</div>
<div class="panel-body">
<form role="form" action="adduser.php" method="post">
<div class="form-group">
<label for="name">Username</label>
<input type="name" name="name" class="form-control" id="name" placeholder="e.g: John Smith" required>
</div>
<div class="form-group">
<label for="pass">Password</label>
<input type="password" name="pass" class="form-control" id="pass" required>
</div>
<div class="form-group">
<label for="email">Email</label>
<input type="email" name="email" class="form-control" id="email">
</div>'; ?>
<div class="form-group">
<label for="group">Group</label>
<select class="form-control" name="group" id="group" required>
<option value="1">Student</option>
<option value="2">Teacher</option>
<option value="0">Admin</option>
</select>
</div>
<button type="submit" class="btn btn-primary">Submit</button>
</form>
</div>
</div>

Answer 1

group is a reserved keyword and you should avoid these words as the column names.
However if you want to use it wrap them in backticks
`group`
Checkout the complete list here http://dev.mysql.com/doc/refman/5.0/en/reserved-words.html
Most of the words in the table are forbidden by standard SQL as column
or table names (for example, GROUP). A few are reserved because MySQL
needs them and uses a yacc parser

Answer 2

The biggest error in your code is the actual mysql_query line:
$result = mysql_query($result);
So the query being run is $result (which is not even set) and the $result is the $result of the query $result? Shouldn’t that use $order instead like this:
$result = mysql_query($order);
And there are a few other issues with your code—including the use of a reserved MySQL name; group—so I have refactored your code to cover all bases. Including reworking your mysql_* calls to use mysqli_* instead since mysql_* is depreciated in PHP versions 5.3 to 5.4 and completely removed from PHP 5.5. Here it is. Notes below:
// Connecting, selecting database
$link = mysqli_connect('DOMAIN', 'USERNAME', 'PASSWORD', 'DATABASE') or die(mysqli_connect_errno());
// Set a '$_POST' array and roll through each value.
$post_array = array('name', 'pass', 'email', 'group');
foreach ($post_array as $post_key => $post_value) {
$$post_value = isset($_POST[$post_value]) && !empty($_POST[$post_value]) ? $_POST[$post_value] : null;
}
// MD5 the password.
$pass = md5($pass);
// Unsure if you need to add slashes if you are using mysqli_stmt_bind_param.
// So including here if you need it. Just change the mysqli_stmt_bind_param to use $email_md5
$email_md5 = addslashes($email);
// Set the query.
$order = "INSERT INTO `users` (`name`, `pass`, `email`, `group`)"
. " VALUES (?, ?, ?, ?)"
;
// Bind the params.
mysqli_stmt_bind_param($order, 'ssss', $name, $pass, $email, $group);
// Run the query.
$result = mysqli_query($link, $order) or die(mysqli_error());
if ($result) {
header("Location: manageusers.php?result=success&name=$name");
}
// Free the result set.
mysqli_free_result($result);
// Close the connection.
mysqli_close($link);
Here is the breakdown of what I did:
Your query line is this: $result = mysql_query($result); but shouldn’t that be $result = mysqli_query($order);? I rewrote that line for mysqli_* but that is the biggest error I found.
I switched your code to use MySQLi extensions which is the preferred way of doing things now since mysql_* is depreciated in PHP versions 5.3 to 5.4 and completely removed from PHP 5.5.
I also set a $_POST array so all of the post keys can be rolled through simply & have some basic validation using isset and !empty. Combing this with mysqli_stmt_bind_param gives you a lot more basic validation than your previous script had.
You are attempting to insert into a table name group but GROUP is actually a MySQL reserved word that should not be used. And if it is used, it should be placed in back ticks like shown in my code.
I am also using the command mysqli_stmt_bind_param to actually bind the parameter to the query which is a simple way to prevent agains MySQL injections. Also using mysqli_free_result and mysqli_close to neatly close the MySQL process.
Your code for the “success” makes no sense. You have an echo with nothing following it on one line, followed by header(…); call then followed by die();. I removed the echo as well as the die() since that is not technically wrong, but that is not really needed.