PHP Mysql提交表格

Question

i am trying to submit data from a html form using php to a sql database. It completed up to part 5 but doesn't appear to be any actual data in any of the table rows apart from the auto increment userID. Also is this code protected from SQL Injection? Also what is the best way to input a datestamp into the SQL database? for example a ClientSince field.

Here is my clientsubmit.php

<?php
// Create connection
echo "Made it! Part 1";
$con=mysqli_connect("xxx","xxx","xxx","xxx");
echo "Made it! Part 2";
// Check connection
if (mysqli_connect_errno())
  {
  echo "Failed to connect to MySQL: " . mysqli_connect_error();
  }
$txtNam = mysql_real_escape_string($_POST["name"]);
$txtEmail = mysql_real_escape_string($_POST["email"]);
$txtSlots = mysql_real_escape_string($_POST["slotcount"]);
$txtSecurity = mysql_real_escape_string($_POST["passcode"]);
echo "Made it! Part 3";
$sql = "INSERT INTO accounts (name, email, slotCount, securityCode)     Values('$txtNam','$txtEmail','$txtSlots','$txtSecurity')";
echo "Made it! Part 4";
if (!mysqli_query($con,$sql))
  {
  die('Error: ' . mysqli_error($con));
  }


echo "Made it! Part 5";

mysqli_close($con);
?>

And here is my form:

<form name="form" class="form" action="clientsubmit.php" method="post">
<input type="text" name="sum2" readonly hidden="true" onChange="updatesum()"     value="1.5"/><br>
Ingame Name: <input type="text" name="name" class="txtbox" /><br><br>
Email Address: <input type="text" name="email" class="txtbox" /><br><br>
Passcode: <input type="text" name="passcode" class="txtbox2" /><br><br>
Slot Count:  <input type="text" name="slotcount" onChange="updatesum()" class="txtbox2"     value="10"/><br><br>
Per Month:  <input name="sum" readonly class="txtboxtotal" style="border: 0px;"     value="15"> Million<br><br>
<input type="submit">
</form>

Added these:

echo "Made it here! 3 ";
echo "   ";
echo $txtNam;
echo "   ";
echo $txtEmail;
echo "   ";
echo $txtSlots;
echo "   ";
echo $txtSecurity;
echo "   ";

and it appears that the variables are not holding any data before submitted to the database.

Got it working with the help of you guys, here is the finished code:

<?php
// Create connection
$con=mysqli_connect("xxxx","xxxx","xxxx","xxxx");
// Check connection
if (mysqli_connect_errno())
  {
  echo "Failed to connect to MySQL: " . mysqli_connect_error();
  die();
  }
$txtNam = mysqli_real_escape_string($con, $_POST["name"]);
$txtEmail = mysqli_real_escape_string($con, $_POST["email"]);
$txtSlots = mysqli_real_escape_string($con, $_POST["slotcount"]);
$txtSecurity = mysqli_real_escape_string($con, $_POST["passcode"]);
$sql = "INSERT INTO accounts (name, email, slotCount, securityCode)     Values('$txtNam','$txtEmail','$txtSlots','$txtSecurity')";
if (!mysqli_query($con,$sql))
  {
  die('Error: ' . mysqli_error($con));
  }

mysqli_close($con);
?>

Answer 1

The issue is you are using mysql_real_escape_string() and using mysqli_*()

change mysql_real_escape_string() to mysqli_real_escape_string()

$txtNam = mysqli_real_escape_string($con, $_POST["name"]);
$txtEmail =  mysqli_real_escape_string($con,$_POST["email"]);
$txtSlots = mysqli_real_escape_string($con,$_POST["slotcount"]);
$txtSecurity = mysqli_real_escape_string($con,$_POST["passcode"]);

Answer 2

你上面提到submit.php ，你在投递表单clientsubmit.php 。