Is there something wrong with the insert.php given below? - php

Question

I have tried hard to debug the following insert.php file. There are no errors while running this and the associated webform file inwamp server, but it is not reading data to the database. Can someone comment on this?
?php
if (isset($_POST['submit'])) {
//Connect to the database
$host="localhost";
$user="root";
$password="";
$dbc=mysql_connect($host,$user,$password) or die("Connection Error");
$db_name="userregistration";
mysql_select_db("$db_name") or die ("Could not select database");
//Reading data from form and writing to the DB
$fname = $_POST['fname'];
$institution = $_POST['institute'];
$email = $_POST['email'];
$phone = $_POST['phone'];
$pgm = $_POST['pgm'];
$address = $_POST['address'];
//Examining for input errors
$error = FALSE;
if (isset($address)) {
$address = trim($address);
$address = strip_tags($address);
}
if (isset($fname) &&
isset($institute) &&
isset($email) &&
isset($phone) &&
isset($pgm) &&
isset($address) &&
$error == FALSE) {
$process = TRUE;
} else {
$process = FALSE;
}
//Writing the multiple answers for user selected programs
while ((list($key,$val) = each($pgm))) {
$pgm .= "[" . $val . "]";
}
//Creating the table
$query = "create table userdata
( sid int unsigned not null auto_increment primary key,
fname char(50) not null,
institute char(50) not null,
email char(50) not null,
phone int unsigned,
pgm text not null,
address char(200) not null)";
$q = mysql_query($query);
//Inserting the data
$query = "insert into userdata values ('','$fname','$institute','$email','$phone','$pgm','$address')";
$q = mysql_query($query);
//Check whether data was properly inserted
if (!$q) {
exit("<p>MySQL Insertion failure.</p>");
} else {
mysql_close();
echo "<p>MySQL Insertion Successful</p>";
}
}
?>
Can someone comment on this ?

Answer 1

try adding
or die(mysql_error());
after your mysql_query($query). That will surely show an error if it failed...

Answer 2

did you try to echo out $q ? it should tell exactly what's wrong when trying to add to database..

Answer 3

//Check whether data was properly inserted
if (!$q) {
die(mysql_error());
exit();
} else {
mysql_close();
echo "<p>MySQL Insertion Successful</p>";
}

Answer 4

My best guess is that the table already exists and so when the user submits the form your code is again trying to create the table 'userdata' which is already there and then dies.
You should remove the create statement out of your code because on every submission it's going to try and create a table that already exists. You should also look about escaping the submtted data before you pass on to an SQL statement as you're just asking for SQL injection attacks as the code stands now.