I have a problem when I click on the submit button there is nothing happened and my data is not being inserted into the database.

Question

0.00/5 (No votes)

See more:

I have a problem when I click on the submit button there is nothing happened and my data is not being inserted into the database.

here is my code.

What I have tried:

db_reg.php

<?php

	$host = "localhost";
	$email = "root";
	$password = "";
		
	$link = mysqli_connect($host, $email, $password) or die ("could not connect");
		
	$db = mysqli_select_db($link, "mdff") or die ("could not select database");

$add_fname=$_POST['fullname'];
$add_email=$_POST['email'];
$add_phone=$_POST['phoneNum'];
$add_password1=$_POST['password1'];
$add_password2=$_POST['password2'];

$query = "INSERT INTO admin(fname,email,phoneNum,password1,password2) VALUES('$add_fname','$add_email','$add_phone','$add_password1','$add_password2')";
$result = mysqli_query($link,$query) or die("query failed");

if($result)
	echo ("<SCRIPT LANGUAGE='JavaScript'>
					window.alert('Sign up Succesfully!.')
					window.location.href='signinUser.html'
					</SCRIPT>");			
else
	echo "Problem occured!";
mysqli_close($link);

?>

register2.html

<!doctype html>
<html class="no-js" lang="en">

<head>
    <meta charset="utf-8">
    <meta http-equiv="x-ua-compatible" content="ie=edge">
    <title>Sign up MDFF</title>
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <link rel="shortcut icon" type="image/png" href="assets/images/icon/fire2.png">
    <link rel="stylesheet" href="assets/css/bootstrap.min.css">
    <link rel="stylesheet" href="assets/css/font-awesome.min.css">
    <link rel="stylesheet" href="assets/css/themify-icons.css">
    <link rel="stylesheet" href="assets/css/metisMenu.css">
    <link rel="stylesheet" href="assets/css/owl.carousel.min.css">
    <link rel="stylesheet" href="assets/css/slicknav.min.css">
    <!-- amchart css -->
    <link rel="stylesheet" href="https://www.amcharts.com/lib/3/plugins/export/export.css" type="text/css" media="all" />
    <!-- others css -->
    <link rel="stylesheet" href="assets/css/typography.css">
    <link rel="stylesheet" href="assets/css/default-css.css">
    <link rel="stylesheet" href="assets/css/styles.css">
    <link rel="stylesheet" href="assets/css/responsive.css">
    <!-- modernizr css -->
    <script src="assets/js/vendor/modernizr-2.8.3.min.js"></script>
</head>

<body>
    <!--[if lt IE 8]>
            <p class="browserupgrade">You are using an outdated browser. Please <a href="http://browsehappy.com/">upgrade your browser</a> to improve your experience.</p>
        <![endif]-->
    <!-- preloader area start -->
    <div id="preloader">
        <div class="loader"></div>
    </div>
    <!-- preloader area end -->
    <!-- login area start -->
    <div class="login-area login-s2">
        <div class="container">
            <div class="login-box ptb--95">
                <form>
                    <div class="login-form-head">
                        <h3>MONITORING & DETECTION FOREST FIRE</h3>
                        <br></br>
                        <h4>Sign Up</h4>
                    </div>
                    <div class="login-form-body" name="register2" action="db_reg.php" method="POST">
                        <div class="form-gp">
                            <label for="Inputfullname">Full Name</label>
                            <input type="text" id="Inputfullname" name="fullname" required>
                            class="ti-user" id="exampleInputEmail1" name="email"__^
                        </div>
                        <div class="form-gp">
                            <label for="exampleInputPhone1">Phone Number</label>
                            <input type="text" id="exampleInputPhone1" name="phoneNum" required>
                            ^__i class="ti-mobile"__^</i>
                        </div>
                        <div class="form-gp">
                            <label for="exampleInputPassword1">Password</label>
                            <input type="password" id="exampleInputPassword1" name="password1" required>
                            ^__i class="ti-lock">
                        </div>
                        <div class="form-gp">
                            <label for="exampleInputPassword2">Confirm Password</label>
                            <input type="password" id="exampleInputPassword2" name="password2" required>
                            ^__i class="ti-lock">
                        </div>
                        <div class="submit-btn-area">
                            <!--<a href="#" class="btn btn-primary btn-md" role="button">Submit   ^__i class="ti-arrow-right"></a>-->
                            <td><input type="submit" value="Submit"></td>
                        </div>
                        <div class="form-footer text-center mt-5">
                            <p class="text-muted">Do have an account? <a href="login2.html">Sign in</a></p>
                        </div>
                    </div>
                </form>
            </div>
        </div>
    </div>
    <!-- login area end -->

    <!-- jquery latest version -->
    <script src="assets/js/vendor/jquery-2.2.4.min.js"></script>
    <!-- bootstrap 4 js -->
    <script src="assets/js/popper.min.js"></script>
    <script src="assets/js/bootstrap.min.js"></script>
    <script src="assets/js/owl.carousel.min.js"></script>
    <script src="assets/js/metisMenu.min.js"></script>
    <script src="assets/js/jquery.slimscroll.min.js"></script>
    <script src="assets/js/jquery.slicknav.min.js"></script>
    
    <!-- others plugins -->
    <script src="assets/js/plugins.js"></script>
    <script src="assets/js/scripts.js"></script>
</body>

</html>

Posted 11-Oct-19 23:19pm
Member 14620455

Updated 12-Oct-19 5:57am

v2

Add a Solution

2 solutions

Top Rated

Most Recent

Please Sign up or sign in to vote.

Solution 1

Accept Solution Reject Solution

The answer is in the documentation: HTML forms[^]. Read it all!

:)

Permalink

Share this answer

Posted 12-Oct-19 1:47am
Luc Pattyn

Please Sign up or sign in to vote.

Solution 2

Accept Solution Reject Solution

PHP

$query = "INSERT INTO admin(fname,email,phoneNum,password1,password2) VALUES('$add_fname','$add_email','$add_phone','$add_password1','$add_password2')";

Not necessary a solution to your question, but another problem you have.
Never build an SQL query by concatenating strings. Sooner or later, you will do it with user inputs, and this opens door to a vulnerability named "SQL injection", it is dangerous for your database and error prone.
A single quote in a name and your program crash. If a user input a name like "Brian O'Conner" can crash your app, it is an SQL injection vulnerability, and the crash is the least of the problems, a malicious user input and it is promoted to SQL commands with all credentials.
SQL injection - Wikipedia[^]
SQL Injection[^]
SQL Injection Attacks by Example[^]
PHP: SQL Injection - Manual[^]
PHP: Prepared statements and stored procedures - Manual[^]
SQL Injection Prevention Cheat Sheet - OWASP[^]
How can I explain SQL injection without technical jargon? - Information Security Stack Exchange[^]

Permalink

Share this answer

Posted 12-Oct-19 5:58am
Patrice T

Updated 12-Oct-19 22:55pm

v2

Comments

Richard MacCutchan 12-Oct-19 12:05pm

That is not concatenation.

Patrice T 12-Oct-19 12:50pm

In PHP it is named 'string interpolation', but result is same.

Richard MacCutchan 12-Oct-19 15:11pm

Then you need to explain how that statement should be coded. As far as I can see there is nothing that will product the problem you describe.

Patrice T 12-Oct-19 16:24pm

This link explain it better than I can
PHP: SQL Injection - Manual[^]

Richard MacCutchan 13-Oct-19 2:48am

Well, the above statement still does not use string concatenation. Look closely and you can see it is a parameter built expression.

Patrice T 13-Oct-19 4:41am

Where do you see prameters here ?
$query = "INSERT INTO admin(fname,email,phoneNum,password1,password2) VALUES('$add_fname','$add_email','$add_phone','$add_password1','$add_password2')"; $result = mysqli_query($link,$query) or die("query failed");

Richard MacCutchan 13-Oct-19 7:03am

All of the fields inside the VALUES set.

Patrice T 13-Oct-19 7:14am

Those are php variables and they are replaced by their contains as the string is stored in $query. Thus the injection.

Richard MacCutchan 13-Oct-19 12:38pm

Thank you. I have re-read the documentation a few times and think I understand now.

Patrice T 13-Oct-19 14:11pm

The devil is on details :)

Patrice T 13-Oct-19 4:48am

see here how parameters work in PHP: PHP: Prepared statements and stored procedures - Manual[^]

Add a Solution

Add your solution here

Plain Text
ASM
ASP
ASP.NET
BASIC
BAT
C#
C++
COBOL
CoffeeScript
CSS
Dart
dbase
F#
FORTRAN
HTML
Java
Javascript
Kotlin
Lua
MIDL
MSIL
ObjectiveC
Pascal
PERL
PHP
PowerShell
Python
Razor
Ruby
Scala
Shell
SLN
SQL
Swift
T4
Terminal
TypeScript
VB
VBScript
XML
YAML

OKPaste as

Strip HTML
Encode HTML
Paste as-is
Code block
Quoted Text
Best guess

To display as

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email

Password

Forgot your password?

Your Email

This email is in use. Do you need your password?

Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

Submit your solution

When answering a question please:

Read the question carefully.

Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.

If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.

Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.
Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Luc Pattyn · Answer 1 · 2019-10-12T01:47:00

Solution 1

The answer is in the documentation: HTML forms[^]. Read it all!

:)

Posted 12-Oct-19 1:47am

Luc Pattyn

Patrice T · Answer 2 · 2019-10-12T05:58:00

Solution 2

PHP

$query = "INSERT INTO admin(fname,email,phoneNum,password1,password2) VALUES('$add_fname','$add_email','$add_phone','$add_password1','$add_password2')";

Not necessary a solution to your question, but another problem you have.
Never build an SQL query by concatenating strings. Sooner or later, you will do it with user inputs, and this opens door to a vulnerability named "SQL injection", it is dangerous for your database and error prone.
A single quote in a name and your program crash. If a user input a name like "Brian O'Conner" can crash your app, it is an SQL injection vulnerability, and the crash is the least of the problems, a malicious user input and it is promoted to SQL commands with all credentials.
SQL injection - Wikipedia[^]
SQL Injection[^]
SQL Injection Attacks by Example[^]
PHP: SQL Injection - Manual[^]
PHP: Prepared statements and stored procedures - Manual[^]
SQL Injection Prevention Cheat Sheet - OWASP[^]
How can I explain SQL injection without technical jargon? - Information Security Stack Exchange[^]

Posted 12-Oct-19 5:58am

Patrice T

Updated 12-Oct-19 22:55pm

v2

Comments

Richard MacCutchan 12-Oct-19 12:05pm

That is not concatenation.

Patrice T 12-Oct-19 12:50pm

In PHP it is named 'string interpolation', but result is same.

Richard MacCutchan 12-Oct-19 15:11pm

Then you need to explain how that statement should be coded. As far as I can see there is nothing that will product the problem you describe.

Patrice T 12-Oct-19 16:24pm

This link explain it better than I can
PHP: SQL Injection - Manual[^]

Richard MacCutchan 13-Oct-19 2:48am

Well, the above statement still does not use string concatenation. Look closely and you can see it is a parameter built expression.

Patrice T 13-Oct-19 4:41am

Where do you see prameters here ?

$query = "INSERT INTO admin(fname,email,phoneNum,password1,password2) VALUES('$add_fname','$add_email','$add_phone','$add_password1','$add_password2')";
$result = mysqli_query($link,$query) or die("query failed");

Richard MacCutchan 13-Oct-19 7:03am

All of the fields inside the VALUES set.

Patrice T 13-Oct-19 7:14am

Those are php variables and they are replaced by their contains as the string is stored in $query. Thus the injection.

Richard MacCutchan 13-Oct-19 12:38pm

Thank you. I have re-read the documentation a few times and think I understand now.

Patrice T 13-Oct-19 14:11pm

The devil is on details :)

Patrice T 13-Oct-19 4:48am

see here how parameters work in PHP: PHP: Prepared statements and stored procedures - Manual[^]