PHP mysql trouble adding data to table - php

Question

I am fairly new at php and I have been trying to insert a series of variables into a mysql database. However, it seems that while the table is being created the data isn't getting entered into the table. I was hoping that someone could tell me why. Any help would be much appreciated.
The php code:
<?php
$team = $_POST['team'];
$int1 = $_POST['int1'];
$int2 = $_POST['int2'];
$int3 = $_POST['int3'];
$int4 = $_POST['int4'];
$int5 = $_POST['int5'];
$int6 = $_POST['int6'];
$int7 = $_POST['int7'];
$int8 = $_POST['int8'];
$int9 = $_POST['int9'];
$int10 = $_POST['int10'];
$int11 = $_POST['int11'];
$int12 = $_POST['int12'];
$int13 = $_POST['int13'];
$int14 = $_POST['int14'];
$con=mysqli_connect("127.0.0.1:3306","root","password","my_db");
// Check connection
if (mysqli_connect_errno())
{
echo "Failed to connect to MySQL: " . mysqli_connect_error();
}
$sqli="CREATE TABLE $team(int1 INT,int2 INT,int3 INT,int4 INT,int5 INT,int6 INT,int7 INT,int8 INT,int9 INT,int10 INT,int11 INT,int12 INT,int13 INT,int14 INT)";
if (mysqli_query($con,$sqli))
{
echo "<br />Table created successfully";
}
else
{
echo "<br />Error creating table: " . mysqli_error();
}
$sql="INSERT INTO $team (int1, int2 ,int3 ,int4 ,int5 ,int6 ,int7 ,int8 ,int9 ,int10 ,int11 ,int12 ,int13 ,int14 )
VALUES ($int1,$int2,$int3,$int4,$int5,$int6,$int7,$int8,$int9,$int10,$int11,$int12,$int13,$int14)";
if (mysqli_query($con,$sql))
{
echo "<br />Record added";
}
else
{
echo "<br />Error adding record";
}
?>

Answer 1

Firstly, you should never insert $_POST values directly into a database, without using strip_tags, htmlentities or some other function to get rid of possible malicious code.
Secondly, I'd recommend looking at the MySQL docs for the proper syntax for creating tables. http://dev.mysql.com/doc/refman/5.1/en/create-table.html

Answer 2

Firstly,its a big security risk to insert data without sanitization(validation).
Secondly, make use of mysqli_error http://php.net/manual/en/mysqli.error.php in php to log or print the error.
because you are inserting data without validation, if any of the variable in $int1.... $int14 is blank or not filled from the form which is requesting the script, your sql query becomes incorrect and fail by generating some sort of syntax error, can be traced using mysqli_error as discussed above.
if (mysqli_query($con,$sql))
{
echo "<br />Record added";
}
else
{
echo "<br />Error ".mysqli_error($con);
}
to see what may become wrong when any of the field is left blank, consider
the values submitted as:
$team = 'tbl_team';
$int1 = 1;
$int2 = 2;
$int3 = 3;
$int4 = 4;
$int5 = '';
$int6 = 6;
$int7 = 7;
$int8 = 8;
$int9 = 9;
$int10 = '';
$int11 = 11;
$int12 = 12;
$int13 = 13;
$int14 = 14;
now see what happens to your sql query if we print it in this case:
$sql="INSERT INTO $team
(int1, int2 ,int3 ,int4 ,int5 ,int6 ,int7 ,
int8 ,int9 ,int10 ,int11 ,int12 ,int13 ,int14 )
VALUES
($int1,$int2,$int3,$int4,$int5,$int6,$int7,
$int8,$int9,$int10,$int11,$int12,$int13,$int14)";
print $sql
will result in:
INSERT INTO tbl_team (int1, int2 ,int3 ,int4 ,int5 ,int6 ,int7 ,int8 ,int9 ,int10 ,int11 ,int12 ,int13 ,int14 )VALUES (1,2,3,4,,6,7,8,9,,11,12,13,14)";
which is by the way a SQL syntax problem.
if you are totally a newbie and have not understood a word yet, you may try to use the following line of code as replacement in your original to have better chances.
$sql="INSERT INTO $team (int1, int2 ,int3 ,int4 ,int5 ,int6 ,int7 ,
int8 ,int9 ,int10 ,int11 ,int12 ,int13 ,int14 )
VALUES
('$int1','$int2','$int3','$int4','$int5','$int6','$int7',
'$int8','$int9','$int10','$int11','$int12','$int13','$int14')";