insert statement using request and session - php

Question

for some reason I cant seem to get the data to insert php and mysql.
I have a init.php with the connection string in, a order.php file and finaly a band_list.php.
I am having some problem getting the data in to database.
the database has 3 tables:
order it has id, order_id and band_id columns
users it has id, name and password columns
bands it has Band_id, name and stock columns
band_list.php has a band gig details in it shown to the user.
<?php
require 'core/init.php';
$Band_id = $_GET['id'];
$result = mysql_query("SELECT * FROM bands WHERE Band_id = $Band_id");
echo "<table border = '1'>
<tr>
<th>Band Name</th>
<th>Venue</th>
<th>Category</th>
<th>Stock</th>
<th>Add</th>
</tr>";
while($row = mysql_fetch_array($result))
{
echo "<tr><form name=\"myform\" action=\" order.php\" method=\"post\">";
echo "<td> <input name=\"band\" type=\"hidden\" value=\"". $Band_id."\" ></td>";
echo "<td>" .$row['Name']. "</td>";
echo "<td>" .$row['Venue']. "</td>";
echo "<td>" .$row['Category']. "</td>";
echo "<td>" .$row['Stock']. "</td>";
echo "<td><button>Buy Ticket</button></td>";
echo "<td><input type=\" submit\" value=\"Buy Ticket\"></td>";
echo "</tr> </form>";
}
echo "</table>";
?>
order.php has the query that is meant to send the data to the database
<?php
require 'core/init.php';
session_start();
$Band_id = $_REQUEST['Band_id'];
$user_id = $_SESSION['user_id'];
$sql = "INSERT INTO orders (band_id,user_id) VALUES($Band_id,$user_id)";
mysql_query ($sql, $linkme)
or die ("could not add to database");
?>
and the connection string is in a init file.
so the idea is when the user clicks buy ticket it gets the current Band_id and user_id and inserts them into the database table orders in to columns band_id and user_id.
This is not happing I am just getting my or die ("could not add to database"); string come up.
Is there a problem with the way I have done it?

Answer 1

<input name=\"band\" type=\"hidden\" value=\"". $Band_id."\" >
And you're trying to get POST variable "Band_id" (which does not exist)
$Band_id = $_REQUEST['Band_id'];
Should be
$Band_id = mysql_real_escape_string($_REQUEST['band']);
Other details:
In order.php, it's better to place "session_start()" at the
beginning (before anything)
Consider using mysqli or PDO instead of deprecated mysql
You could get band id with $_POST instead of $_REQUEST because your
form sends it with post method