使用php脚本和来自Android的httppost向在线数据库添加数据

Question

In my app I ahve a specific form for the user to complete and I want to store these data in my online DB.

Here is my code in java:

public void send_data_to_DB(){
         String result = "";
         InputStream is = null;
         StringBuilder sb=null;
         ArrayList<NameValuePair> nameValuePairs = new ArrayList<NameValuePair>();//() before
         nameValuePairs.add(new BasicNameValuePair("table", table));
         nameValuePairs.add(new BasicNameValuePair("code", Integer.toString(code)));
         nameValuePairs.add(new BasicNameValuePair("name", name));
         nameValuePairs.add(new BasicNameValuePair("email", email));
            try{
                HttpClient httpclient = new DefaultHttpClient();
                HttpPost httppost = new HttpPost("http://myurl.php");
                HttpEntity entity = new UrlEncodedFormEntity(nameValuePairs);
                httppost.addHeader(entity.getContentType());
                httppost.setEntity(entity);
                HttpResponse response = httpclient.execute(httppost);
                //HttpEntity entity = response.getEntity();
                //is = entity.getContent();
        }catch(Exception e){
                Log.e("log_tag", "Error in http connection "+e.toString());
        }
     }

And Here is my php script:

<?php

    mysql_connect("dserver","User","Code");

    mysql_select_db("DB_Name");

$table.=$_POST['table'];
$code.=$_POST['code'];
$name.=$_POST['name'];
$email.=$_POST['email'];

  $q=mysql_query(" INSERT INTO {$table} (code,name,email) VALUES ({$code},{$name},{$email}) ")or die(mysql_error());


mysql_close();
?>

I think it must be something in my php and the way I am assigning or using the variables but I am not quite experienced in PHP. Can you help me?

Answer 1

On PHP side it must be .= instead of =. .

EDIT:

The quotes in the SQL statement are missing:

Change to

"INSERT INTO {$table} (code,name,email) VALUES ('{$code}','{$name}','{$email}')"

Answer 2

$table=.$_POST['table'];
$code=.$_POST['code'];
$name=.$_POST['name'];
$email=.$_POST['email'];

you have extra dot after every equal sign, that probably causes syntax error.

Your other problem is sql injection vulnerability, always check /escape properly values before using in query.