Click here to Skip to main content
15,914,221 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
Hi I am a beginner in PHP and MySQl, I am making a website that can view a database, add data to database and delete data from a database. I have written code for a form page which allows the user to add data to the database.

The code doesn't contain any errors, the form appears, you can enter the details and click the submit button with no issues. But it does not actually add the information entered to the database.

Here is the code for my "New.php"






PHP
<title>New Record

	

	
		
	<?php
     if(isset($_POST["ID"])){
	
    $ID = $_POST['ID'];
	$ProductName = $_POST['ProductName'];
	$Price = $_POST['Price'];
	$Stock = $_POST['Stock'];
	 }
	
	// if there are any errors, display them
    $error='';
	if ($error != '');
	 
	{

	echo '<div style="padding: 4px; color: red">'.$error.'</div>';
//if assist
	}

	?>

	

	<div>
	   
	ID:  <br>

	ProductName:  <br>

	Price:   <br>
	
	Stock:   <br>

	

	</div>

	

	

	

	<?php
	
	//connect to database
		 $con = mysqli_connect("localhost","root","");
		 if (!$con) 
		 {
			 mysqli_select_db("stationaryonlinecustomers", $con);
		 }

	
	// check if the form has been submitted. If it has, start to process the form and save it to the database

	if (isset($_POST['submit']))

	{

	// get form data, making sure it is valid

	$ID = mysqli_real_escape_string($con, htmlspecialchars($_POST['ID']));

	$ProductName = mysqli_real_escape_string($con,htmlspecialchars($_POST['ProductName']));

    $Price = mysqli_real_escape_string($con,htmlspecialchars($_POST['Price']));
       
    $Stock = mysqli_real_escape_string($con,htmlspecialchars($_POST['Stock']));
      
	}

	// check to make sure both fields are entered
    $ID='';
	if ($con == '' || $ID == '' || $ProductName == '' || $Price == '' || $Stock =='')

	{

	// generate error message

	$error = 'ERROR: Please fill in all required fields!';
	
	}

	else{
	// save the data to the database

	$u = mysql_query($con, "INSERT productorders SET ID='".$ID."', ProductName='".$ProductName."', Price='".$Price."', Stock='".$Stock."'");
	

	// once saved, redirect back to the view page

	header("location:View.php");


	// if the form hasn't been submitted, display the form

	renderForm('','','');

	}

	?></

What am I missing ?

What I have tried:

Youtube tutorials, Tutorials from different websites and books on PHP and MySql
Posted
Updated 13-Mar-18 1:48am
v2
Comments
Richard MacCutchan 13-Mar-18 7:10am    
You should check the return value from your mysql_query call.

PHP
$u = mysql_query($con, "INSERT productorders SET ID='".$ID."', ProductName='".$ProductName."', Price='".$Price."', Stock='".$Stock."'");

Not a solution to your question, but another problem you have.
Never build an SQL query by concatenating strings. Sooner or later, you will do it with user inputs, and this opens door to a vulnerability named "SQL injection", it is dangerous for your database and error prone.
A single quote in a name and your program crash. If a user input a name like "Brian O'Conner" can crash your app, it is an SQL injection vulnerability, and the crash is the least of the problems, a malicious user input and it is promoted to SQL commands with all credentials.
SQL injection - Wikipedia[^]
SQL Injection[^]
SQL Injection Attacks by Example[^]
PHP: SQL Injection - Manual[^]
SQL Injection Prevention Cheat Sheet - OWASP[^]
 
Share this answer
 
You are mixing mysql and mysqli. The line
PHP
$u = mysql_query($con, "INSERT productorders SET ID='".$ID."', ProductName='".$ProductName."', Price='".$Price."', Stock='".$Stock."'");
should be
PHP
$u = mysqli_query($con, "INSERT productorders SET ID='".$ID."', ProductName='".$ProductName."', Price='".$Price."', Stock='".$Stock."'");

You should also check the return value stored in the variable $u. If that is FALSE, the insert operation failed and you can get the error message by calling mysqli_error($con).
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900