trying to get PHP and database to work together - php

Question

I'm trying to teach myself how to work with php and mysql. For practice, I made a simple test website that takes a username and a password, and a database using phpmyadmin and mysql. I was able to create a successful connection to my DB, but now I'm trying to take the data from the form on my website and insert it into a table called 'account'. Account has three fields: 'username', 'password', and 'userID'(primary key). user ID is supposed to auto increment, so that field doesn't require input data. I wrote code that I thought would collect the username and password and add it as a new record in the account table, but I get an error message:
Internal Server Error
The server encountered an internal error or misconfiguration and was
unable to complete your request.
Additionally, a 404 Not Found error was encountered while trying to
use an ErrorDocument to handle the request.
Below I've included my code. I've never worked with PHP before or made a DB before so it's possible I've made very obvious mistakes.
php_script
<?PHP
$db_host = "stevie.heliohost.org";
$db_username = "secret";
$db_pass = "secret";
$db_name = "secret";
$connection = #mysql_connect ("$db_host","$db_username", "$db_pass")
or die ("could not connect to mySQL");
#mysql_select_db("$db_name") or die ("No database");
$sql="INSERT INTO account(username, password)
VALUES('$_POST[user]','$_POST[password]')";
if (!mysql_query($sql,$connection ))
{die('Error: ' . mysql_error());}
echo "1 record added";
mysql_close($con);
?>
HTML FORM
<form name="LOGIN" action="php_script.php" method="post">
Username: <input id="username" type="text" name="user">
password: <input id="password" type="text" name="password">
<input id="submit" type="submit" value="Submit">
</form>

Answer 1

try this out
$db_host = 'stevie.heliohost.org';
$db_username = "secret";
$db_pass = "secret";
$db_name = "secret";
$connection = mysql_connect($db_host,$db_username, $db_pass)
or die ("could not connect to mySQL");
mysql_select_db($db_name) or die ("No database");
$sql="INSERT INTO account(username, password)
VALUES('".$_POST[user]."','".$_POST[password]."')";
if (!mysql_query($sql,$connection ))
{die('Error: ' . mysql_error());}
echo "1 record added";
mysql_close($con);
OBS: u should use mysqli or PDO , your code is easy for sql injections

Answer 2

If you are teaching yourself PHP, the First thing you should do is learn PDO. Because, the way you are using mysql, you are leaving your site open for SQL-Injection type of hacking, which anyone can do. Since you are directly submitting the value of $_POST['']; in your database. Start learning PDO today, it is much more secure. You can find the a good tutorial here: http://wiki.hashphp.org/PDO_Tutorial_for_MySQL_Developers
Additionally, Check this code as I have modified it a little bit. and host name, is almost always localhost
<?PHP
$db_host = "localhost";
$db_username = "secret";
$db_pass = "secret";
$db_name = "secret";
$connection = mysql_connect ("$db_host","$db_username", "$db_pass")
or die ("could not connect to mySQL");
mysql_select_db("$db_name") or die ("No database");
$sql="INSERT INTO account(username, password)
VALUES('$_POST[user]','$_POST[password]')";
if (!mysql_query($sql,$connection ))
{die('Error: ' . mysql_error());}
echo "1 record added";
mysql_close($con);
?>

Answer 3

First of all you shouldn't be using mysql_ functions because they are being deprecated. Try to use PDO or likes.
second try this
$db_host = 'stevie.heliohost.org';
$db_username = "secret";
$db_pass = "secret";
$db_name = "secret";
$connection = mysql_connect($db_host,$db_username, $db_pass)
or die ("could not connect to mySQL");
mysql_select_db($db_name) or die ("No database");
$sql="INSERT INTO account(username, password)
VALUES('".mysql_escape_string($_POST[user])."','".mysql_escape_string($_POST[password])."')";
if (!mysql_query($sql,$connection ))
{die('Error: ' . mysql_error());}
echo "1 record added";
mysql_close($con);
you should be escaping your values in your query too so the its not up for SQL injection
I am not up for for using mysql_escape_string either you should be using atleast mysqli
So go through a good tutorial to learn more about it