Can't convert URL into hyperlink to store in MySQL - php

Question

Sorry to be back two days in a row. I spent the whole day yesterday reading on this site and others and I'm just stuck. The only thing I found close was for C++. I'm building a data base for my DVDs and Movies so I and my friends can search by Title, Actors, etc. With help here yesterday, I was able to get a data entry form working. One of the fields is a hyperlink to IMDB for info about the movie. I want to just be able to paste the URL into the form but have it stored as a full hyperlink in MySQL. When it comes up in the results pages it just appears as a link I can click on and go to the IMDB page.
This is what I've come up with so far. I get a syntax error if I include the "target="_blank"> but if I take that out there's no syntax error but I get the "Error X" with no error code and no entry into the database. Is there any way I can get this to work? Thanks in advance.
// Make link info into hyperlink for database
$url = ('$_POST[link]');
$f_link = "IMDB Movie Page";
// Write data to table.
$sql="INSERT INTO movies (Movies, Rating, Genre, Year, Actors, Time, Notes, Viewed, BitRate, link)
VALUES ('$_POST[Movies]','$_POST[Rating]','$_POST[Genre]','$_POST[Year]','$_POST[Actors]','$_POST[ Time]','$_POST[Notes]','$_POST[Viewed]','$_POST[BitRate]', $f_link)";
if (!mysqli_query($con,$sql))
{
die('Error: X ' . mysql_error($con));
}

Answer 1

To your question about the quotes:
consider the following sql:
$sql = "SELECT * from table1 where id = god";
mysql interpret got as some thing else than a string ('god' is different from got).
therefore you should type
$sql = "SELECT * from table1 where id = 'god'";
or
$value = 'god';
$sql = "SELECT * from table1 where id = '{$value}'";
or
$value = 'god';
$sql = "SELECT * from table1 where id = '" . $value . "'";
Note: in case the value is a Numeric (flaot, integer, ... ), then you don't neet the quote
$value = 12334;
$sql = "SELECT * from table1 where id = {$god}";

Answer 2

I recommend that you store the plain $url in the database without the HTML. If you later want to change your link you would have to work out how to update all your records... If you switch your code to just store the URL without adding HTML around it, it will fix the error (which is unescaped quoted).
When you retrieve the URL from the database, you can wrap it with your HTML and avoid that pain.
You are doing great to get started in just a couple of days with this - but you may need to have a think about SQL injection as even if you don't think someone will deliberately attack your page, you could accidentally cause problems if you don't parametrise your SQL - for example if someone accidentally types a ' into the form.

Answer 3

You need to escape quotes when you want to include them inside a quoted string.
$f_link = "IMDB Movie Page";
but you should also have quote around the URL
$f_link = "IMDB Movie Page";
Using single quotes to enclose makes it easier,
$f_link = 'IMDB Movie Page';
but bear in mind PHP doesn't parse the contents in this instance, which isn't a problem in that line because you've concatenated $url, which is the cleaner way.
Also note you're leaving yourself open to SQL injection be allowing those $_POSTs to be directly inserted into a SQL command.

Answer 4

Replace your code through:
$url = ($_POST['link']);
$f_link = "IMDB Movie Page";
// Write data to table.
$sql="INSERT INTO movies (Movies, Rating, Genre, Year, Actors, Time, Notes, Viewed, BitRate, link)
VALUES
('" . $_POST['Movies'] ."', '" . $_POST['Rating'] . "', '" . $_POST['Genre'] . "', '" . $_POST['Year']" . ', '" . $_POST['Actors'] ."', '" . $_POST['Time'] . "', '" . $_POST['Notes'] . "','" . $_POST['Viewed'] . "','" . $_POST['BitRate'] . "', '{$f_link}' )";
if (!mysqli_query($con,$sql))
{
die('Error: X ' . mysql_error($con));
}