blank data when inserting into MySQL database with PHP

Question

I made a form to insert and modify categories in my project. when i hit "submit" i get the record submitted into the database but it appears empty ! and if i go to the databse field and write the text myself it will appear good in MySQL and and "????" in the browser !

here is the code i wrote:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<body>

 <?php
$con = mysql_connect("localhost","user","pass");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("mydb", $con);

$sql="INSERT INTO categories (name, parent_id,description)
VALUES
('$_POST[name]','$_POST[parent_id]','$_POST[description]')";

if (!mysql_query($sql,$con))
  {
  die('Error: ' . mysql_error());
  }
echo "1 record added";

mysql_close($con)
?>

<form action="ins.php" method="post">
category: <input type="text" name="name" /><br><br>
parent: <input type="text" name="parent_id" /><br><br>
description: <input type="text" name="description" /><br><br>

<input type="submit" />
</form>

</body>
</html>

Answer 1

You have to quote (using ") around your index name in your SQL request because $_POST is an array:

$sql="INSERT INTO categories (name, parent_id,description)
VALUES
('".$_POST["name"]."','".$_POST["parent_id"]."','".$_POST["description"]."')";

But generally speaking please dont trust directly what's user are posting to your script to avoid SQL Injections. You can use mysqli::query which is way better and safer :

Mysqli

Answer 2

First sanitize your user input.

If you after that want to use the values from the array without all the concatenation everyone else mentions use {} around array accessors.

$sql="INSERT INTO categories (name, parent_id, description)
VALUES
('{$_POST['name']}','{$_POST['parent_id']}','{$_POST['description']}')";

To clean for example $_POST do something like this is a good start. This is a bit of my older code. As others have written use mysqli instead

function clean_array($t_array)
{
    foreach($t_array as $key=>$value)
        $array[$key] = mysql_real_escape_string( trim($value) );

    return $t_array;
}

Answer 3

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<body>

 <?php
 if ($_POST['action']=="doformpost") {
    //only do DB insert if form is actually posted

    $con = mysql_connect("localhost","user","pass");
    if (!$con)
      {
      die('Could not connect: ' . mysql_error());
      }

    mysql_select_db("mydb", $con);

    $sql="INSERT INTO categories (name, parent_id,description)
    VALUES
    ('".$_POST['name']."','".$_POST['parent_id']."','".$_POST['description']."')";


    if (!mysql_query($sql,$con))
      {
      die('Error: ' . mysql_error());
      }
    echo "1 record added";

    mysql_close($con)
}
?>

<form action="ins.php" method="post">
<input type="hidden" name="action" id="action" value="doformpost" />
category: <input type="text" name="name" /><br><br>
parent: <input type="text" name="parent_id" /><br><br>
description: <input type="text" name="description" /><br><br>

<input type="submit" />
</form>

</body>
</html>

Answer 4

$sql="INSERT INTO categories (name, parent_id,description)
VALUES
("'.$_POST['name'].'","'.$_POST['parent_id'].'","'.$_POST['description'].'")";

Please provide quotes while inserting values in database

Answer 5

Try using double quotes in your statement like this:

$sql="INSERT INTO categories (name, parent_id,description) VALUES ("'.$_POST['name'].'","'.$_POST['parent_id'].'","'.$_POST['description'].'")";

Answer 6

lots of issues here.

$_POST[name] should be $_POST['name']
your query will run even if the form is not submitted.
you are using deprecated mysql_* functions. Use PDO or mysqli
Your code is vulnerable to sql injection

With all that out, here's what you need to do.

Just to verify that the form is submitted, use

if( !empty($_POST['name']) && 
!empty($_POST['parent_id']) && 
!empty($_POST['description']) )

(use isset if empty value is allowed.)

Then run the query.

In PDO, the code will look like this ->

<?php
// configuration
$dbtype     = "mysql";
$dbhost             = "localhost";
$dbname     = "mydb";
$dbuser     = "user";
$dbpass     = "pass";

// database connection
$conn = new PDO("mysql:host=$dbhost;dbname=$dbname",$dbuser,$dbpass);

// query
$sql = "INSERT INTO categories (name, parent_id,description)
        VALUES
       (?,?,?)";
$q = $conn->prepare($sql);
$q->execute(array($_POST[name],$_POST[parent_id],$_POST[description]));


?>

This is just a start. you can use try and catch block to catch exceptions.

Before running query, check if form is submitted by !empty() or isset() as described above.

Answer 7

use this statement for your code

if( isset($_POST['name']) && isset($_POST['parent_id']) && isset($_POST['description']) )

//your insert query

Answer 8

Don't forgot about safety!

$sql="INSERT INTO categories (name, parent_id,description)
VALUES
('".mysql_real_escape_string($_POST['name'])."','".intval($_POST['parent_id'])."','".mysql_real_escape_string($_POST['description'])."')";

And i think a problem with encodings.

launch query before you inserting a data:

$sql = 'set names `utf-8`'; (for example)

Answer 9

Use Below insert query to insert data , im sure it will definitely help you.

$sql="INSERT INTO categories (name,parent_id,description)
VALUES
('".$_POST['name']."','".$_POST['parent_id']."','".$_POST['description']."')";

Answer 10

Try this

<?php
if(isset($_POST['submit'])) {
    $con = mysql_connect("localhost","user","pass");
    if (!$con){
      die('Could not connect: ' . mysql_error());
    }
    mysql_select_db("mydb", $con);

    $sql="INSERT INTO categories (name, parent_id,description) VALUES
    ('".$_POST['name']."','".$_POST['parent_id']."','".$_POST['description']."')";

    if (!mysql_query($sql,$con)) {
      die('Error: ' . mysql_error());
    } else {
        echo "1 record added";
    }
    mysql_close($con);
}
?>
<html>
<body>
<form action="<?php $_SERVER['PHP_SELF'] ?>" method="post">
category: <input type="text" name="name" /><br><br>
parent: <input type="text" name="parent_id" /><br><br>
description: <input type="text" name="description" /><br><br>
<input type="submit"name="submit" value="Submit" />
</form>
</body>
</html>

Answer 11

Me too faced the same problem.

Proceed your insert query like this, this helped me.

$email_id = $_POST['email_id'];
$device_id = $_POST['device_id'];
***For My Sqli***
if(!empty($email_id ))
    {
        $result_insert = mysqli_query($db_conn,"INSERT INTO tableName (user_email, user_device_id,last_updated_by) VALUES('".$email_id."', '".$device_id."', '".$email_id."') ");

        if(mysqli_affected_rows($db_conn)>0)
        {
            $response["success"] = 1;
            $response["message"] = "Successfully Inserted";
        }
        else
        {
            $response["success"] = 0;
            $response["message"] = "Problem in Inserting";
        }
    }
    else
    {

        $response["success"] = 4;
        $response["message"] = "Email id cannot be Blank";
    }
}
///////////////////////////////////////////////////////////////////////////////
 **For My Sql**
if(!empty($email_id ))
    {
        $result_insert = mysql_query("INSERT INTO tableName (user_email, user_device_id,last_updated_by) VALUES('".$email_id."', '".$device_id."', '".$email_id."') ");

        if(mysql_affected_rows()>0)
        {
            $response["success"] = 1;
            $response["message"] = "Successfully Inserted";
        }
        else
        {
            $response["success"] = 0;
            $response["message"] = "Problem in Inserting";
        }
    }
    else
    {

        $response["success"] = 4;
        $response["message"] = "Email id cannot be Blank";
    }
}

NOTE : here i have checked only for email.

blank data when inserting into MySQL database with PHP

Question

11 answers

solution1
2 2013-01-23 09:47:23

solution2
1 2016-01-28 19:23:34

solution3
0 2013-01-23 09:46:58

solution4
0 2013-01-23 09:48:38

solution5
0 2013-01-23 09:59:19

solution6
0 2013-01-23 10:02:00

solution7
-1 2013-01-23 09:48:31

solution8
-1 2013-01-23 09:50:47

solution9
-1 2013-01-23 11:19:01

solution10
-1 2014-12-15 17:04:58

solution11
-1 2015-08-12 12:59:26

blank data when inserting into MySQL database with PHP

Question

11 answers

solution1 2 2013-01-23 09:47:23

solution2 1 2016-01-28 19:23:34

solution3 0 2013-01-23 09:46:58

solution4 0 2013-01-23 09:48:38

solution5 0 2013-01-23 09:59:19

solution6 0 2013-01-23 10:02:00

solution7 -1 2013-01-23 09:48:31

solution8 -1 2013-01-23 09:50:47

solution9 -1 2013-01-23 11:19:01

solution10 -1 2014-12-15 17:04:58

solution11 -1 2015-08-12 12:59:26

solution1
2 2013-01-23 09:47:23

solution2
1 2016-01-28 19:23:34

solution3
0 2013-01-23 09:46:58

solution4
0 2013-01-23 09:48:38

solution5
0 2013-01-23 09:59:19

solution6
0 2013-01-23 10:02:00

solution7
-1 2013-01-23 09:48:31

solution8
-1 2013-01-23 09:50:47

solution9
-1 2013-01-23 11:19:01

solution10
-1 2014-12-15 17:04:58

solution11
-1 2015-08-12 12:59:26