Add MySQL entry from PHP web page - php

Question

I am developing a web application that allows a user to add entries to a MySQL database through a web form. The web form posts to the same page, some PHP code captures that data and sends it to MySQL. For whatever reason, nothing ever makes it to MySQL. This is the code I have so far that isn't working:
<?php
include("config.inc.php");
$Name=$_POST['AddName'];
$Group=$_POST['AddGroup'];
$Grade=$_POST['AddGrade'];
$Position=$_POST['AddPosition'];
$Email=$_POST['AddEmail'];
$HomeAddress=$_POST['AddHomeAddress'];
$City=$_POST['AddCity'];
$State="SC";
$Zip=$_POST['AddZIP'];
$CellPhone=$_POST['AddCellNumber'];
$HomePhone=$_POST['AddHomeNumber'];
$FirstPeriod=$_POST['AddFirstPeriod'];
$SecondPeriod=$_POST['AddSecondPeriod'];
$ThirdPeriod=$_POST['AddThirdPeriod'];
$FourthPeriod=$_POST['AddFourthPeriod'];
$FifthPeriod=$_POST['AddFifthPeriod'];
$SixthPeriod=$_POST['AddSixthPeriod'];
$SeventhPeriod=$_POST['AddSeventhPeriod'];
$Homeroom=$_POST['AddHomeroom'];
$dbpassword=$_POST['AddPassword'];
$con = mysql_connect("127.0.0.1","$username","******");
if (!$con)
{
die();
}
mysql_select_db("$database", $con);
$sql="INSERT INTO names (Name,Grp,Grade,Position,Email,HomeAddress,City,State,Zip,CellPhone,HomePhone,FirstPeriod,SecondPeriod,ThirdPeriod,FourthPeriod,FifthPeriod,SixthPeriod,SeventhPeriod,Homeroom)
VALUES('$Name','$Group','$Grade','$Position','$Email','$HomeAddress,'$City','$State','$Zip','$CellPhone','$HomePhone','$FirstPeriod','$SecondPeriod','$ThirdPeriod','$FourthPeriod','$FifthPeriod','$SixthPeriod','$SeventhPeriod','$Homeroom')";
if (!mysql_query($sql,$con))
{
die();
}
echo "1 record added";
mysql_close($con)
?>
</body>
</html>

Answer 1

Try this and see what it says:
if (!mysql_query($sql,$con))
{
die(mysql_error());
}

Answer 2

Try inserting echo mysql_error();. This should give you at least a starting place to where your query is incorrect.

Answer 3

mysql_close($con) should have a semi-colon at the end.
check your log for errors.
use mysql_real_escape_string

Answer 4

PHP hides errors. To debug, start by placing these two lines as the first lines within the <?php tag
error_reporting(E_ALL);
ini_set('display_errors', '1');
Also in case the error was in mysql you can do:
print_r(mysql_fetch_array(mysql_query("SHOW WARNINGS", $con)));
or
print_r(mysql_fetch_array(mysql_query("SHOW ERRORS", $con)));
Directly after the mysql query you think may have failed.

Answer 5

die(mysql_error());
will fix it.
Also have a look at escaping. It would be very easy to inject into the current code.
If you are not going to escape (I don't know when you would do that) you might as well use the $_POST rather than assigning to a variable and using the variable.

Answer 6

change your database selection to
mysql_select_db("database name")
or
mysql_select_db($database);
your are trying to select a database named "$database" with a dollar sign as a string, not the name in that variable.
also, use
mysql_real_escape_string($sql) to escape those variables.(avoiding sql injecion) you can find links about it in other comments.

Answer 7

change
$sql="INSERT INTO names (Name,Grp,Grade,Position,Email,HomeAddress,City,State,Zip,CellPhone,HomePhone,FirstPeriod,SecondPeriod,ThirdPeriod,FourthPeriod,FifthPeriod,SixthPeriod,SeventhPeriod,Homeroom)
VALUES('$Name','$Group','$Grade','$Position','$Email','$HomeAddress,'$City','$State','$Zip','$CellPhone','$HomePhone','$FirstPeriod','$SecondPeriod','$ThirdPeriod','$FourthPeriod','$FifthPeriod','$SixthPeriod','$SeventhPeriod','$Homeroom')";
to
$sql="INSERT INTO names (Name,Grp,Grade,Position,Email,HomeAddress,City,State,Zip,CellPhone,HomePhone,FirstPeriod,SecondPeriod,ThirdPeriod,FourthPeriod,FifthPeriod,SixthPeriod,SeventhPeriod,Homeroom)
VALUES('$Name','$Group','$Grade','$Position','$Email','$HomeAddress','$City','$State','$Zip','$CellPhone','$HomePhone','$FirstPeriod','$SecondPeriod','$ThirdPeriod','$FourthPeriod','$FifthPeriod','$SixthPeriod','$SeventhPeriod','$Homeroom')";