How to get the submitted form data in mysql database table - php

Question

I wrote this following piece of code & it must echo "Sign up successful" if pswd = retype pswd
& later INSERT the following values into the TABLE (WHICH ISN'T). It simply echo's Sign up successful but the values are not inserted into TABLE. I'm pretty much sure that i failed in connecting to DB in my PHP code, please correct my code!
My Code is as follows:
<?php
session_start();
include('header.php');
$mysql_host = 'localhost';
$mysql_user = 'root';
$mysql_pass = '1234';
$mysql_db = "my_db";
if (!mysql_connect($mysql_host, $mysql_user, $mysql_pass) || !mysql_select_db($mysql_db))
{
die(mysql_error());
}
if( isset( $_REQUEST['namevar'] ) ){
$nmvar = $_REQUEST['namevar'];
$email = $_REQUEST['name1'];
$psvar = $_REQUEST['p1'];
$cpsvar = $_REQUEST['p2'];
$gender = $_REQUEST['r1'];
$clvar = $_REQUEST['t2'];
$plvar = $_REQUEST['t1'];
if($psvar == $cpsvar)
{
$sql = "INSERT INTO `users` (name,email,password,confirm password,gender,college,place)
VALUES ('$nmvar','$email','$psvar','$cpsvar','$gender','$clvar','$plvar')";
mysql_query($sql);
echo "Signup successful";
}
else
{
echo "Password Mismatch";
}
}
?>
<form action="" method="post">
Name:
<input type="text" name="namevar" /><br/>
E-mail:
<input type="text" name="name1" /><br/>
Password:
<input type="password" name="p1" /><br/>
Confirm Password:
<input type="password" name="p2" /><br/>
Gender:
<input type="radio" name="r1" />
Male
<input type="radio" name="r1" />
Female
<br/>
Location:
<input type="text" name="t1" /><br/>
College:
<input type="text" name="t2" /><br/>
<input type="submit" value="submit" /><br/>
<input type="reset" value="reset" />
</form>

Answer 1

You should use the mysql_real_escape_string() function on the data before submitting it into the database. Otherwise, your code is at risk for SQL injection.