我的数据未存储在数据库中

Question

I can't seem to figure out what is wrong with my code. I am trying to get it to take the input from

<form id="contact-form" action="emails.php" method="post">
    <input placeholder="Please enter your email address" name="emailz" type="email" tabindex="2" required>
    <input type="submit" name="submit" id="contact-submit" value="Subscribe">
</form>

and have it saved into my database.

Here is my PHP file:

$servername = "localhost";
$username = "poweilup";
$password = "bloop";
$dbname = "poweilup_emails";

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

$insert = "INSERT INTO emails(addressEmail) VALUES($_POST '$emailz')";
$conn->close();

Answer 1

Here is how you do the insert -

$servername = "localhost";
$username = "poweilup";
$password = "bloop";
$dbname = "poweilup_emails";

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

$stmt = $conn->prepare("INSERT INTO `emails`(`addressEmail`) VALUES(?)");
$stmt->bind_param('s', $email);

$email = $_POST('emailz');
$stmt->execute();

First you prepare the query and leave placeholders for the item variables. The you bind each parameter(variable) and then declare them. Finally you execute the query.

Answer 2

To use MySQLi in a safe way, it's best to use Prepared Statements . This will prevent your users from inserting SQL injection or, possibly by mistake, inserting characters that can cause problems to your MySQL server.

As you can see in the script below, I'm first preparing the SQL query, using a placeholder "?" for the item variable. After I'm binding the parameter(variable) to this placeholder.

Now the query is setup correctly, it's time to execute it. It's always a good habit to close anything left open once done, as it will free up memory that's no longer in use.

<?php

/* DB Info */
$servername = "localhost";
$username = "poweilup";
$password = "bloop";
$dbname = "poweilup_emails";

/* MySQLi Object */
$conn = new mysqli($servername, $username, $password, $dbname);

/* check connection */
if (mysqli_connect_errno()) {
    printf("Connect failed: %s\n", mysqli_connect_error());
    exit();
}

/* Prepare query */
if ($stmt = $conn->prepare("INSERT INTO emails (addressEmail) VALUES (?)")){

    /* Bind POST data */
    $stmt->bind_param("s", $_POST['emailz']);

    /* Run query */
    $stmt->execute();

    /* Close statement */
    $stmt->close();
}

/* Close connection */
$conn->close();

?>

Answer 3

First check if the user hasn't missed anything:

if (isset($_POST['emailz']) { //code here.. };

In the code here... section, store the value of emailz in a variable like this:

$emailz = $_POST['emailz'];

Of course this may be insecure for more important data like passwords. You should use the hash() function then.

For inserting the variable in DB, try this:

$query = "INSERT INTO `user` (emailz) VALUES ('$emailz')"; $result = mysql_query($query);     //inserts the variable in the DB.