Current location: Hot Scripts Forums » Programming Languages » PHP » PHP - SQL Database Query Problem


PHP - SQL Database Query Problem

Reply
  #1 (permalink)  
Old 01-02-12, 04:22 PM
shnips6 shnips6 is offline
New Member
 
Join Date: Dec 2011
Posts: 1
Thanks: 0
Thanked 0 Times in 0 Posts
PHP - SQL Database Query Problem

I am trying to process my first online form with PHP. From my troubleshooting I beleive it is connecting to the database but is having a query problem. I am sure the fix will be quite basic as this is my first attempt at processing a form but I seem to have hit a wall.
If anybody can take a look at my php script and see if any problem sticks out, it would be greatly appreciated.
Thanks a lot. Below is my script:
PHP Code:

<?php
    $property_type 
$_POST['property_type'];
    
$number_of_bedrooms $_POST['#_of_bedrooms'];
    
$number_of_bathrooms $_POST['#_of_bathrooms'];
    
$state_province $_POST['state_province'];
    
$city $_POST['city'];
    
$address $_POST['address'];
    
$name $_POST['name'];
    
$email $_POST['email'];
    
$phone $_POST['phone'];
    
$additional_info $_POST['additional_info'];
$dbc mysqli_connect('localhost''********''******''circlema_propertydatabase')or die('Error connecting to MySql server');
    
$query "INSERT INTO circlema_propertydatabase (property_type, number_of_bedrooms, number_of_bathrooms, state_province, city, address, " 
        
"name, email, phone, additional_info) " .
        
"VALUES ('$property_type', '$number_of_bedrooms', '$number_of_bathrooms', '$state_province', '$city', '$address', " 
        
"'$name', '$email', '$phone', '$additional_info')";
$result mysqli_query($dbc$query) or die('Error querying database.');
        
mysqli_close($dbc);
?>

Last edited by Nico; 01-03-12 at 06:11 AM.
Reply With Quote
  #2 (permalink)  
Old 01-03-12, 06:15 AM
Nico's Avatar
Nico Nico is offline
Community Leader
 
Join Date: Sep 2005
Location: Spain
Posts: 8,075
Thanks: 11
Thanked 88 Times in 83 Posts
1st: Don't post your username and password on the internet (I removed it for you now)
2nd: Instead of using or die('Error querying database.');, use or die(mysqli_error());. That'll give you an exact error message.
3rd: Don't ever put direct user input into your SQL strings. That leaves your site widely open to SQL injections. Call mysqli_real_escape_string() on every user defined variable you're putting into this string.

PHP Code:

$name mysqli_real_escape_string($_POST['name']); 

This is very important. Read this.
Reply With Quote
Reply

Bookmarks

Tags
database query, mysql, php, sql


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Mysql and php database seach for web-site Terezza PHP 0 04-24-10 01:38 PM
query database LAN MIND JavaScript 1 02-24-08 03:43 AM
MYSQL Distinct Query problem FunkyM PHP 20 02-28-07 08:33 AM
Complex mysql sorting pb (Get cat_list from cids &pcids with 1 query, willing to pay) aqw PHP 1 06-23-05 07:02 PM


All times are GMT -5. The time now is 08:59 AM.
vBulletin® Copyright ©2000 - 2012, Jelsoft Enterprises Ltd.