Inserting form data to a mysql database

Question

I have tried multiple times to get this code to run and insert the data into a my database. No matter what I try I cannot figure out the problem. The php looks like this:

<?php
// Create connection
$conn = mysqli_connect("localhost","nmhsmusi_admin" , "********", "nmhsmusi_musicdb");

// Check connection
if (mysqli_connect_errno())
{
    echo "Failed to connect to MySQL: " . mysqli_connect_error();
}

if (isset($_POST['submit']))
{

    $titleTag = $_POST['title'];
    $composerTag = $_POST['composer'];
    $unicodeTag = $_POST['unicode'];
    $tempoTag = $_POST['tempo'];
    $yearTag = $_POST['year-used'];
    $languageTag = $_POST['language'];
    $keyTag = $_POST['key-signature'];
    $pianoTag = $_POST['piano'];
    $temposelTag = $_POST['temposel'];
    $partsTag = $_POST['parts'];

    $run = mysqli_query($conn,"INSERT INTO musicdb (title, composer, unicode, temptxt, yearused, languages, pianokeys, piano, temposel, parts)
        VALUES
        (
            '$titleTag', '$composerTag', '$unicodeTag', '$tempoTag', '$yearTag', '$languageTag', '$keyTag', '$pianoTag', '$temposelTag', '$partsTag'
        )");

    if ($run) {
        echo "New record created successfully";
    } else {
        echo "failed";
    }
    mysqli_close($conn);
}
?>

Any help would be greatly appreciated

Answer 1

Why do you use mysqli? Has it already fallen into disuse? PDO is now used.

Here's an example:

<?php
if (isset($_POST['submit'])) {

    $titleTag = $_POST['title'];
    $composerTag = $_POST['composer'];
    $unicodeTag = $_POST['unicode'];
    $tempoTag = $_POST['tempo'];
    $yearTag = $_POST['year-used'];
    $languageTag = $_POST['language'];
    $keyTag = $_POST['key-signature'];
    $pianoTag = $_POST['piano'];
    $temposelTag = $_POST['temposel'];
    $partsTag = $_POST['parts'];

    try {
        $pdo = new PDO(DSN,DBUSER,DBUSERPASSWD);
    } catch (PDOException $e) {
        echo "Failed to connect to Database: " . $e->getMessage() . "\n"; die();
    }
    $pdo->exec("SET NAMES 'utf8' COLLATE 'utf8_general_ci'");

    $sql = "INSERT INTO musicdb (title, composer, unicode, temptxt, yearused, languages, pianokeys, piano, temposel, parts)
    VALUES (:titleTag,:composerTag,:unicodeTag,:tempoTag,:yearTag,:languageTag,:keyTag,:pianoTag,:temposelTag,:partsTag)";
    $query = $pdo->prepare("$sql");
    $query->bindValue(':titleTag',$titleTag);
    $query->bindValue(':composerTag',$composerTag);
    $query->bindValue(':unicodeTag',$unicodeTag);
    $query->bindValue(':tempoTag',$tempoTag);
    $query->bindValue(':yearTag',$yearTag);
    $query->bindValue(':languageTag',$languageTag);
    $query->bindValue(':keyTag',$keyTag);
    $query->bindValue(':pianoTag',$pianoTag);
    $query->bindValue(':temposelTag',$temposelTag);
    $query->bindValue(':partsTag',$partsTag);
    $query->execute();
    if($query->rowCount() > 0){
        echo "New record created successfully!";
    } else {
        echo "Error!";
    }
}
?>

Of course you need to filter everything that comes from the form with regular expressions. Easy thing to do!

Once the regular expressions have analyzed everything you need to convert everything to htmlentities to avoid malicious code:

The regular expression "/([a-zÀ-ÿ0-9\\s]+)/i" below allows only letters with or without accents, numbers, and spaces:

<?php
preg_match('/([a-zÀ-ÿ0-9\s]+)/i', $_POST['any_field_form'], $output);
if((isset($output[1]) == true) and ($output[1] != null)) {
    //Convert everything to htmlentities to avoid malicious code
    $get_the_data = htmlentities($output[1], ENT_QUOTES, 'UTF-8', false);
} else {
    $get_the_data = null;
}
?>

With this you avoid problems with forms. Of course for each form field you will have to do a specific regular expression. But that makes your code smarter.

Sorry if there are any errors in the text. I know how to read in English, but I do not know how to write so I used a translator for that. But that's it, boy!