SQL INSERT INTO 给出错误而不解释； 通过语法测试

Question

I created a modal form to capture complete contact information and upload to database. Worked perfectly. Used exact same code to create a second modal window to use for login. Eliminated excess code. Continue to get exact same error message:

Error: INSERT INTO team_members (id, username, password) VALUES (NULL, 'hfuller', 'davidson')

I have created a testing file and it connects. I simply cannot update to the database. I even tried copying and pasting an instructor's example file. That file also failed to update database.

Here is my code (I changed database reference; everything else matched my database):

<?php

include('connection.php');

if( isset( $_POST["add"] ) ) {

    // build a function that validates data
    function validateFormData( $formData ) {
        $formData = trim( stripslashes( htmlspecialchars( $formData ) ) );
        return $formData;
    }

    // set all variables to empty by default
    $username = $password = "";

    // check to see if inputs are empty
    // create variables with form data
    // wrap the data with our function

    if( !$_POST["username"] ) {
        $nameError = "Please enter a username <br>";
    } else {
        $username = validateFormData( $_POST["username"] );
    }

    if( !$_POST["password"] ) {
        $passwordError = "Please enter a password <br>";
    } else {
        $password = validateFormData( $_POST["password"] );
    }


    // check to see if each variable has data
     if( $username && $password ) {
        $query = "INSERT INTO team_members (id, username, password)
        VALUES (NULL, '$username', '$password')";

        if( mysqli_query( $conn, $query ) ) {
            echo "<div class='alert alert-success alert-dismissible'><button type='button' class='close' data-dismiss='alert'><span>&times;</span></button><strong>Credentials are authenticated!</strong> You can now proceed to do the great work that you do!</div>";
        } else {
            echo "Error: ". $query . "<br>" . mysqli_error($conn);
        }
    }

}
mysqli_close($conn);

?>



<!-- Modal for Request Information Packet -->
        <form class="modal fade form-horizontal" id="team_login" action="<?php echo htmlspecialchars( $_SERVER['PHP_SELF'] ); ?>" method="post">            
            <div class="modal-dialog modal-lg">            
                <div class="modal-content">                
                    <div class="modal-header">
                        <button type="button" class="close" data-dismiss="modal"><span>&times;</span></button>
                        <h3 class="modal-title"><span class="glyphicon glyphicon-lock"></span>&nbsp;Login to the ICTUS Team Portal</h3>
                        <p>You must enter the correct username and password in order to open the ICTUS Team Member Portal.</p>            
                    </div>
                    <div class="modal-body">

                        <div class="center-block text-center">
                            <img class="img-thumbnail img-circle" src="https://lh5.googleusercontent.com/-b0-k99FZlyE/AAAAAAAAAAI/AAAAAAAAAAA/eu7opA4byxI/photo.jpg?sz=120" alt="Warning Sign"><br><br>
                            <p><strong>Just a reminder that the information included in the team portal is subject to our Confidentiality Agreement and cannot be shared without prior written permission. Thank you for your cooperation.</strong></p><br><br>

                            <div class="form-group">
                                <label class="col-sm-3 control-label"><small class="text-danger">* <?php echo $nameError; ?>* <?php echo $passwordError; ?></small>Login Credentials: </label>
                                <div class="col-sm-4">
                                    <input type="text" placeholder="Enter Username" name="username" class="form-control">
                                </div>
                                <div class="col-sm-4">
                                    <input type="password" placeholder="Enter Password" name="password" class="form-control">
                                </div>
                            </div>
                        </div>
                    </div>

                    <div class="modal-footer">
                        <button type="button" class="btn btn-lg btn-default" id="information" data-dismiss="modal">Cancel</button>
                        <button type="submit" name="add" class="btn btn-lg btn-default" id="information">Log In</button>
                    </div>
                </div>
            </div>
        </form>

I know that this is not secure, etc. It is the first step in creating a secure login page that I am working on. I am just really stuck on the first page and cannot find the problem. Like I said, the more complex complete contact information collection form in a modal window works perfect.

Answer 1

Looking at this query:

INSERT INTO team_members (id, username, password)
                VALUES (NULL, '$username', '$password')

If id is meant to identify the record then NULL isn't going to do a very good job of that. How would one identify any given record if all identifiers are NULL ? Also, if it's a primary key then it's likely to be NOT NULL and would need a unique value for any given row.

My guess is that id is an auto-incrementing column, or in some other way automatically generating its value in the database itself. If that's the case, omit it from the query entirely:

INSERT INTO team_members (username, password)
                VALUES ('$username', '$password')

Basically, don't try to supply a value if the database is meant to create one itself. The database will prioritize the one you supply over any attempt to create one.

---

As a side note, you may want to look into using prepared statements and query parameters. Sanitizing input is a good thing, but it's still just covering up the underlying problem. Which is that you're creating user input as code instead of as a value . Using query parameters treats the input as a value and doesn't try to execute it.