Data not inserting into database

Question

So I have my form that sends data to my php file that then enters it into the database. Here's the php backend part

<?php
 $db = new mysqli('localhost','root','x','app');
 $username = $_POST['username'];

 $db->query("INSERT INTO people (first_name) VALUES ('{$username}'");

?>

But my question is, why isn't username being put into the database?

You should echo the `$username` value to debug. Also, your query allows `$_POST` value directly insert into database, which may cause SQL Injection. — Raptor, Apr 30 '14 at 03:15
You're missing a bracket `)` in `("INSERT INTO people (first_name) VALUES ('{$username}'")` change to: `("INSERT INTO people (first_name) VALUES ('{$username}')")` — Funk Forty Niner, Apr 30 '14 at 03:17
So would that take care of all the injection problems? @nunu — , Apr 30 '14 at 03:20

score 5 · Accepted Answer · edited May 23 '17 at 12:11

You are missing a bracket ) in the following line:

("INSERT INTO people (first_name) VALUES ('{$username}' ")
                                                       ^ // <= right there

change it to:

("INSERT INTO people (first_name) VALUES ('{$username}')")

Yet, as pointed out in comments, you are open to SQL injection when using your present method.

Use prepared statements, or PDO.

Here follows an example of a prepared statement:

<?php
error_reporting(E_ALL);
ini_set('display_errors', 1);
mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);

$mysqli = @mysqli_connect('localhost', 'xxx', 'xxx', 'my_db');

if (!$mysqli) {
    die('Connect Error: ' . mysqli_connect_error());
}

// $username = $_POST['username'];
$username = mysqli_real_escape_string($mysqli,$_POST['username']);

   $sql = ("INSERT INTO people (first_name) VALUES (?)");

    $stmt = $mysqli->prepare($sql) or die("Failed Execution");
    $stmt->bind_param('s', $username);

    $stmt->execute();
    echo $stmt->error;

echo "SUCCESS";

    exit();

Plus, using error reporting is important before going live.

http://www.php.net/mysqli_error

Should you want to get into learning PDO,

Here are a few tutorials for you to look into:

Here is a PDO example:

<?php

    $mysql_hostname = 'xxx';
    $mysql_username = 'xxx';
    $mysql_password = 'xxx';
    $mysql_dbname = 'xxx';

    try{

    $db= new PDO("mysql:host=$mysql_hostname;dbname=$mysql_dbname", $mysql_username, $mysql_password); 

$email = $_POST['email'];
$username = $_POST['username'];

$result_set = $db->prepare("INSERT INTO `yourTable` (`email`, `username`) 

 VALUES (:email, :username)");

$result_set->bindParam(1, $email);
$result_set->bindParam(2, $username);

$result_set->execute(array(':email' => $email, ':username' => $username));

    echo "Data successfully written.";

        return $db;
    }catch(PDOException $e){
        echo $e;
        return false;
    }

?>

PDO error handling links:

That's for a _super_ good answer and error reporting is enabled — , Apr 30 '14 at 03:41
Thank you, I appreciate the comment @user302975 Glad I could help. :) — Funk Forty Niner, Apr 30 '14 at 03:42
Just one question. For the prepared statement would I have to only do the username, or do I just do the same thing for both? — , Apr 30 '14 at 15:42
@user302975 You can use just one field if you wish and remove the `username` and then the `$result_set->bindParam(2, $username);` and `, ':username' => $username` also. Any reference to `username` should be removed if only using the one. — Funk Forty Niner, Apr 30 '14 at 15:57

Data not inserting into database

1 Answers1