PHP, MySQL Insert Into table in localhost - php

Question

I'm pretty new to MySQL and PHP, and I had a little problem with Inserting into table.
I have build 'setup.php' that have all MySQL codes but I didn't know how to included correctly to 'index.php'.
I tried to separate the code as the following, but still didn't work. I don't know what's the problem here, is it the code itself? or the way i included it? Please help me fix it.
index.php, The code is right after body element.
if (isset($_POST['name']) &&
isset($_POST['email']) &&
isset($_POST['place']) &&
isset($_POST['level'])) {
include "setup.php";
$name = sanitizeString($_POST['name']);
$email = sanitizeString($_POST['email']);
$place = sanitizeString($_POST['place']);
$level = sanitizeString($_POST['level']);
$query = "INSERT INTO customers VALUES('$name', '$email', '$place', '$level')";
queryMysql($query);
}
setup.php
<?php
$dbhost = 'localhost';
$dbname = 'applicants';
$dbuser = 'root';
$dbpass = 'root';
mysql_connect($dbhost, $dbuser, $dbpass) or die(mysql_error());
mysql_select_db($dbname) or die(mysql_error());
function createTable($name, $query) {
if (tableExists($name)) {
echo "Table $name already exists";
}
else {
queryMysql("CREATE TABLE $name($query)");
}
}
function tableExists($name) {
$result = queryMysql("SHOW TABLES LIKE $name");
return mysql_num_rows($result);
}
function queryMysql($query) {
$result = mysql_query($query);
return $result;
}
createTable('customers',
'name VARCHAR(16),
email VARCHAR(16),
place VARCHAR(16),
level VARCHAR(16)');

Answer 1

Using PDO is a better approach:
function validatePost($post) {
return (isset($post['name']) &&
isset($post['email']) &&
isset($post['place']) &&
isset($post['level']));
}
function createTable(PDO $pdo, $name, $query) {
if (tableExists($pdo, $name)) {
throw new Exception("Table already exists");
}
$pdo->query("CREATE TABLE $name($query)");
}
function tableExists(PDO $pdo, $name) {
$result = $pdo->query("SHOW TABLES LIKE $name");
return count($result->fetchAll());
}
$dbhost = 'localhost';
$dbname = 'applicants';
$dbuser = 'root';
$dbpass = 'root';
validatePost($_POST);
try {
$pdo = new PDO("mysql:host=$dbhost;dbname=$dbname", $dbuser, $dbpass);
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
createTable($pdo, "customers",
"name VARCHAR(16),
email VARCHAR(16),
place VARCHAR(16),
level VARCHAR(16)");
$stmt = $pdo->prepare("INSERT INTO `customers` (`name`, `email`, `place`, `level`) VALUES(:name, :email, :place, :level)");
$stmt->bindParam(":name", $_POST["name"]);
$stmt->bindParam(":email", $_POST["email"]);
$stmt->bindParam(":place", $_POST["place"]);
$stmt->bindParam(":level", $_POST["level"]);
$stmt->execute();
}
catch (PDOException $e) {
echo "There was an error regarding the Database: " . $e->getMessage();
die();
}
catch (Exception $e) {
echo "Error! " . $e->getMessage();
}
You have a PDO object which acts as the connection, it is then passed around the functions in order to operate.
Points
PDO supports prepared statements, which removes the need to sanitize (the prepared statement does it for you!)
When inserting, it's considered a good practice to expicitely declare which column gets what, I've assumed the names of your columns, but you should change them if they don't match.
Don't echo, throw Exceptions. Throwing an exception allows you to deal with problems and errors in your code much more efficiently and easily. You throw an exception and catch it where it may occur. An uncaught (catched) exception will terminate the script.

Answer 2

In index.php, the query should be
mysql_query($query)
not queryMysql.
Plus, make sure you are inserting every field in the database. If you have auto increment field or field which you aren't using, use this syntax
INSERT INTO products (column 1, column 2) VALUES (value1, value2)
p.s. Change your all queryMysql to mysql_query(). I believe there's no function like queryMysql (i have stopped using this mysql_* functions long ago so i could be wrong but about mysql_query() i am sure that it'l work).