Form data not being sent to MySql database

Question

Have a simple registration form that is being linked to a php file in order to send the info to a database but everytime i try it the data isnt showing up in the phpMyAdmin database??

<?php

$name = $_POST['name'];
$address = $_POST['address'];
$number = $_POST['number'];
$email = $_POST['email'];
$details = $_POST['details'];

$user="root";
$password="secure";
$database="darrenweircharity";
mysql_connect("localhost",$user,$password);
@mysql_select_db($database) or die ("Unable to select database");

$query = "INSERT INTO registrationdetails(name, address, number, email, details)".
"VALUES('$name', '$address', '$number', '$email', '$details' NOW())";
mysql_query($query);
mysql_close();
?>

Answer 1

Please, don't use mysql_* functions in new code . They are no longer maintained and the deprecation process has begun on it. See the red box ? Learn about prepared statements instead, and use PDO , or MySQLi - this article will help you decide which. If you choose PDO, here is a good tutorial .

Try with:

$query = "INSERT INTO registrationdetails(name, address, number, email, details)".
         "VALUES('" . $name . "', '" . $address . "', '" . $number . "', '" . $email . "', '" . $details . "');";

You have NOW() at the end of the query that shouldn't be there.

Also note that your code has an SQL injection vulnerability (see mysql_real_escape_string() ), I suggest you to prepare queries via PDO .

Answer 2

protect from possible SQL injection:

$name = mysql_real_escape_string($name);
$address = mysql_real_escape_string($address);
$number = mysql_real_escape_string($number);
$email = mysql_real_escape_string($email);
$details = mysql_real_escape_string($details);

replace with:

$query = "
INSERT INTO registrationdetails (`name`, `address`, `number`, `email`, `details`)
VALUES ('$name', '$address', '$number', '$email', '$details')");

Answer 3

$query = "
    INSERT INTO registrationdetails (name, address, number, email, details, date_time)
    VALUES ('{$name}', '{$address}', '{$number}', '{$email}', '{$details}', NOW())
";

Replace the date_time with your column_name. And remember to escape all submitted values with mysql_real_escape_string before inserting them into the database.