PHP insert into table issue - php

Question

Me again. I'm really new to PHP though have been really trying hard to practice, so terms are a little iffy right now.
My issue at the moment is my CMS can't seem to submit data to a MySQL table. Here is my function:
function newEntry() {
$query = mysql_query("INSERT INTO entries VALUES(null,'name','description','content')") or die(mysql_error());
}
Here is my form for submitting content:
<form action="doNewEntry.php" method="post">
<textarea name="entTitle" id="entTitle">Entry Title</textarea><br>
<textarea name="entDesc" id="entDesc">Input Description Here</textarea><br>
<textarea name="entCont" id="entCont">Type and format content here! What you see, is what you get.</textarea><br>
<script>
CKEDITOR.replace( 'entCont' );
</script>
<table><td colspan="2"><input type="submit" name="submit" /></td></table>
</form>
And here is the in between file to make the post:
<?php
include('includes/functions.php');
if(isset($_POST['submit'])) {
if(isset($_POST['entTitle'])) {
newEntry($_POST['entTitle'],$_POST['entDesc'],$_POST['entCont']);
header("Location: entries.php");
} else {
echo "Please fill out all fields!";
include('newEntry.php');
}
}
?>
I'm incredibly new to this, so it's no doubt a very simple fix. Maybe just missed something but I really cannot figure it out. ADD problems. :(

Answer 1

function newEntry()
You have passed the parameters to this function but dint received in definition.
function newEntry($title, $description ,$content){
//your code here
}
Need to reform this query
$query = mysql_query("INSERT INTO entries VALUES(null,'name','description','content')") or die(mysql_error());

Answer 2

You need to pass your variables in your function so add arguments to your function, otherwise it won't work, also your variable should be prepended by $ in your query, so change the function as follow
function newEntry($name, $description, $content)
{
$query = mysql_query("INSERT INTO entries VALUES(null,'$name','$description','$content')") or die(mysql_error());
}
As side note i would say that your code is higly vulnerable to mysql injections. I would rather switch to either PDO or mysqli and use prepared statments to avoid any risk.