<form> and $_POST with sql in php [closed] - php

Question

Closed. This question needs details or clarity. It is not currently accepting answers.
Want to improve this question? Add details and clarify the problem by editing this post.
Closed 8 years ago.
Improve this question
I have this form list:
<form action="">
Inlognaam: <input type="text" name="inlognaam">
</form>
Now i want it that if you put there text in, the text will set into the database.
// Create connection
$con=mysqli_connect("localhost","root","","phpexpr");
// Check connection
if (mysqli_connect_errno())
{
echo "Failed to connect to MySQL: " . mysqli_connect_error();
}
$inlognaam = $_POST['inlognaam'];
if(isset($POST['inlognaam'])){
$filename = $_POST['inlognaam'];
}
if(isset($filename)){
echo $filename;
}
$sql = 'INSERT INTO gebruikers (inlognaam) VALUES('.$filename.')';
mysql_query($sql);
if (!mysql_query($sql,$con))
{
die('Error: ' . mysql_error());
}
echo "1 record added";
mysql_close($con);
?>
I got this code, but i don't know what there is wrong and what schould be changed.
Can somebody help me please? :)

Answer 1

There are several flaws with your code:
you don't specify a method, so your form will be sent with GET, whereas you use $_POST variables in your PHP code. Use
<form action="" method="POST">
you are mixing mysql_* functions and mysqli_* functions. Don't use the former anymore, those are deprecated. Use either MySQLi or PDO (I prefer the latter). If you can't decide which, this article will help you. If you pick PDO, here is a good tutorial.
you're performing two queries here (resulting in two INSERTs):
mysql_query($sql);
if (!mysql_query($sql,$con))
just catch the value of the first query (and use mysqli_query if you want to use MySQLi).
last but not least, due to your string concatanation of your query, you're open to SQL injection. Switch to prepared statements like this:
$sql = 'INSERT INTO gebruikers (inlognaam) VALUES (?)';
$stmt = $con->prepare($sql);
$stmt->bind_param('s', $filename);
$success = $_stmt->execute();
if ($success) {
…

Answer 2

Use the method name POST at the line <form action="" method="post">
and one thing you have mistake that use $_POST NOT $POST in the line
if(isset($POST['inlognaam'])){
$filename = $_POST['inlognaam'];
}

Answer 3

Here,
When you dont specify method attributes of form tag, then default it will use GET method to post data.
So set or use $_REQUEST to get data from html file which independant of form method.

Answer 4

The form maybe like this <form action="" method="POST">
try it

Answer 5

Can you give us an error if you're getting one? I see that you're using a MySQLI connection but you're putting everything in the database with just a MySQL query.
You need this code:
<form action="" method="POST">
<?php
// Create connection
$con = mysqli_connect("localhost","root","","phpexpr");
// Check connection
if (mysqli_connect_errno())
{
echo "Failed to connect to MySQLI: " . mysqli_connect_error();
}
$inlognaam = trim($_POST['inlognaam']);
if(isset($_POST['inlognaam']))
{
$filename = trim($_POST['inlognaam']);
}
if(isset($filename))
{
echo $filename;
}
$sql = 'INSERT INTO gebruikers (inlognaam) VALUES('.$con->real_escape_string($filename).')';
$con->query($sql);
if (!mysqli_query($sql,$con))
{
die('Error: ' . mysqli_error());
}
echo "1 record added";
mysqli_close($con);
?>
I've used OO side of MySQLI because I'm not used to produceral side of MySQLI, apoliges for that and the bad English from my side.
I also see that you didn't declared the action in your form, you need to use POST if you wont that user can post informatie that you can send to your DB.