Click here to Skip to main content
15,909,039 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
hi there

i am trying to insert into my database but for some reason it will not insert. it was working good a while aback for some reason it will not work ah mean it stop inserting names into the database. when I run it it will go back to my root page ah mean the index page but the information frm the registration form is not inserting into the database which is what I want it to do.

can someone throw a third eye for me cuz iike i am missing something and i have to hand this up by midnight tonight

here is what i have

What I have tried:

PHP
<pre>

<?php

		 
		if(isset($_POST['enter']))
		{
				//capture the variable from the form and store in php variables
			 
			
			$title=$_POST['title'];
			$firstname=$_POST['firstname'];
			$lastname=$_POST['lastname'];
			$username=$_POST['username'];
			$email=$_POST['email'];
			$gender=$_POST['gender'];
			
			$address=$_POST['address'];
			$mypwd=$_POST['mypwd'];
			
			
			
			include'db_server.php';
			
			//select the database you want to query
			
			$sql="SELECT * FROM members WHERE username='$username'";
			$result= mysqli_query($conn, $sql) or die ("ERROR:" .mysqli_error());
			$rowcount=mysqli_num_rows($result);
			
			if($rowcount >= 1) //checking to see if usernamename is already exist
			{
				 echo "<script type=\"text/javascript\">
					  alert('Username already exits');
					  window.location=\"../login_user.html\";
					   </script>";
			}
			else
			{
				//insert data into table
				
				$sql = "INSERT INTO members
				VALUES('$title', '$firstname', '$lastname', '$username', '$email', '$gender', '$address', md5('$mypwd'))";
			
				if(mysqli_query($conn,$sql))
				{
					mysqli_close($conn);
					
					echo "<script type=\"text/javascript\">
					  alert('Username already exits');
					  window.location=\"../index.html\";
					   </script>";
							
				}
				else
				{
					echo "Error inserting values into database";
				}
				//end of line
				
			}
		}	
		
			
?>
Posted
Updated 30-Mar-19 13:06pm
Comments
Richard Deeming 4-Apr-19 14:17pm    
As I told you last year[^], an unsalted MD5 hash is not much better than storing the password in plain text. You should use the built-in functions to manage your passwords securely:

PHP: password_hash[^]
PHP: password_verify[^]
divinity02 4-Apr-19 21:58pm    
hi richard deeming, that is the only way I know how to hash a password, it wat i was taught and what the lecturer is looking for, she is very picky
Richard Deeming 5-Apr-19 7:24am    
She is also very wrong. :)

1 solution

PHP
$sql="SELECT * FROM members WHERE username='$username'";
$sql = "INSERT INTO members VALUES('$title', '$firstname', '$lastname', '$username', '$email', '$gender', '$address', md5('$mypwd'))";

Not necessary a solution to your question, but another problem you have.
Never build an SQL query by concatenating strings. Sooner or later, you will do it with user inputs, and this opens door to a vulnerability named "SQL injection", it is dangerous for your database and error prone.
A single quote in a name and your program crash. If a user input a name like "Brian O'Conner" can crash your app, it is an SQL injection vulnerability, and the crash is the least of the problems, a malicious user input and it is promoted to SQL commands with all credentials.
SQL injection - Wikipedia[^]
SQL Injection[^]
SQL Injection Attacks by Example[^]
PHP: SQL Injection - Manual[^]
SQL Injection Prevention Cheat Sheet - OWASP[^]
How can I explain SQL injection without technical jargon? - Information Security Stack Exchange[^]
 
Share this answer
 
v2

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900