[Mister B.]

Parse error: parse error in /home/chaotice/public_html/signupresponse.php on line 6

PHP Code:

mysql_query("INSERT INTO structure (usanameish, usapassish, usaemailish, usamsnish, usaaimish, usahooish, usaallowemailish) VALUES ({$_POST['usernamer']},{$_POST['userpasser']},{$_POST['useremailer']},{$_POST['usermsner']},{$_POST['useraimer']},{$_POST['useryahooer']},{$_POST['allow']})"; 

Brain explode

[<?Wille?>]

try this.. with quotes around the values

PHP Code:

mysql_query("INSERT INTO structure (usanameish, usapassish, usaemailish, usamsnish, usaaimish, usahooish, usaallowemailish) VALUES ('{$_POST['usernamer']}', '{$_POST['userpasser']}', '{$_POST['useremailer']}', '{$_POST['usermsner']}', '{$_POST['useraimer']}', '{$_POST['useryahooer']}', '{$_POST['allow']}')"; 

hope it helps
Wille

[NeverMind]

what <?Wille?> said and you forgot to close the "(" after the function call ..
so use this:

PHP Code:

 mysql_query("INSERT INTO structure (usanameish, usapassish, usaemailish, usamsnish, usaaimish, usahooish, usaallowemailish) VALUES ('{$_POST['usernamer']}', '{$_POST['userpasser']}', '{$_POST['useremailer']}', '{$_POST['usermsner']}', '{$_POST['useraimer']}', '{$_POST['useryahooer']}', '{$_POST['allow']}')"); 

[infinitylimit]

I always have to have single quotes around the fieldnames also, that is how PMA does it.

PHP Code:

 mysql_query("INSERT INTO structure ('usanameish', 'usapassish', 'usaemailish', 'usamsnish', 'usaaimish', 'usahooish', 'usaallowemailish') VALUES ('{$_POST['usernamer']}', '{$_POST['userpasser']}', '{$_POST['useremailer']}', '{$_POST['usermsner']}', '{$_POST['useraimer']}', '{$_POST['useryahooer']}', '{$_POST['allow']}')"); 

weird field names

[NeverMind]

Originally Posted by infinitylimit

I always have to have single quotes around the fieldnames also, that is how PMA does it.

PHP Code:

 mysql_query("INSERT INTO structure ('usanameish', 'usapassish', 'usaemailish', 'usamsnish', 'usaaimish', 'usahooish', 'usaallowemailish') VALUES ('{$_POST['usernamer']}', '{$_POST['userpasser']}', '{$_POST['useremailer']}', '{$_POST['usermsner']}', '{$_POST['useraimer']}', '{$_POST['useryahooer']}', '{$_POST['allow']}')"); 

weird field names

PMA uses back quotes ` not '
running your query will generate an error ..

[Acecool]

Hey, I feel that using the set method is better.

$Query = "INSERT INTO structure SET usanameish='" . $_POST['blah'] . "', usapassish='" . $_POST['blahblahblah'] . "', and='so on'";
mysql_query($Query);

BUT, putting information directly from the form to your database is INSECURE

[infinitylimit]

Nevermind, you are correct my mistake. ` backquotes it is.

[NeverMind]

we all do mistakes

[Mister B.]

How is it insecure? How can I make it more secure?

[blaw]

Hello there,

How is it insecure?

For one, if a user entered troublesome characters like single quote without escaping, whatever database operation you are trying to do will fail, which could cause unexpected problems.

Another thing is that if this is for something like forum scripts like this one where the user input will be displayed to the public, you should pay attention to malicious codes. For instance, adding <pre> or something would make your site look really ugly. Worse, if someone tries inserting malicious javascript, your site could become a gateway to information theft, etc (you can see <pre>'s < and > got escaped with htmlentities()) or something in here).

How can I make it more secure?

At the very least, you should escape the troublesome characters in the data input with addslashes(). If, however, your php's magic_quotes_gpc is true, then GET, POST, and COOKIE will be automatically addslashes()-ed, so do not worry about this or you would be adding two more unnecessary slashes. Nevertheless, just because it is true today doesn't mean it will stay the same tomorrow - especially if you are staying with a shared host, so check this value first with get_magic_quotes_gpc().

Simple example would be:

PHP Code:

if ($_POST['sbtSubmit']) {

    if (!get_magic_quotes_gpc()) {

        $a_post = array_map('addslashes', $_POST);

    }

    else {

        $a_post = $_POST;

    }

} 

The above will get all your POSTed values into $a_post, addslashes()-ed. You can come up with your own, depending on your script's needs.

Good luck!