why is insert into not working

Question

I made this code

<?php
  mysql_connect ("localhost","root","root");
  mysql_select_db ("new");
  $newusername=$_POST ['newusername'];
  $newpassword=$_POST ['newpassword'];
  $submit=$_POST ['submit'];
  if($submit) {
    $newaccount= "INSERT INTO users (name,password) VALUES ("$newusername","$newpassword")";
    $result=mysql_query($newaccount);
    if ($result) {
      print "account has been created"."<meta http-equiv="refresh" content="5;login.php">";
    }
    else {
      echo " The account is already exist";
    }
  }
?>

but it says error on line 8 which is " insert into" line

It's probably the way you've done your variables in the string, try using `'` instead of `"`. Also, please look into MySQLi or PDO as mysql is deprecated — Andy Holmes, Jul 22 '14 at 07:42

score 1 · Answer 1 · answered Jul 22 '14 at 07:42

1

There is a problem with double quotes. You can add concatenation:

$newaccount = "INSERT INTO users (name,password) VALUES ('" . $newusername . "','" . $newpassword . "')";

P.S. Don't use mysql_* functions (mysql extension is deprecated), use mysqli_* instead.

answered Jul 22 '14 at 07:42

Phantom

1,704
4
17
32

2

The query will fail for string values `$newusername` and `$newpassword` – Abhik Chakraborty Jul 22 '14 at 07:45
1

P.S. Don't recommend insecure SQL practices. – user2864740 Jul 26 '14 at 01:16

score 0 · Answer 2 · answered Jul 22 '14 at 07:42

0

You used wrong quoting:

$newaccount= "INSERT INTO users (name,password) VALUES ('$newusername','$newpassword')";

answered Jul 22 '14 at 07:42

AHaberl

328
2
12

See http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php?rq=1 – user2864740 Jul 26 '14 at 01:17
I know about SQL injections but I didn`t want to make my answer more complicated than necessary... – AHaberl Jul 28 '14 at 07:18

score 0 · Answer 3 · answered Jul 22 '14 at 09:24

Sorting out the quotes and using mysql_real_escape_string to sanitise the input (and prevent an easy SQL injection attack):-

<?php
mysql_connect("localhost","root","root");
mysql_select_db ("new");
$newusername = mysql_real_escape_string($_POST['newusername']);
$newpassword = mysql_real_escape_string($_POST['newpassword']);
$submit = $_POST['submit'];
if($submit) 
{
    $newaccount = "INSERT INTO users (name, password) VALUES ('$newusername', '$newpassword')";
    $result = mysql_query($newaccount);
    if ($result) 
    {
        print "account has been created"."<meta http-equiv='refresh' content='5;login.php'>";
    }
    else 
    {
        echo " The account is already exist";
    }
}
?>

Although this would work and fixes the problem(s), guess what; OP's site apparently got hacked http://stackoverflow.com/q/24966531/ - You'll be able to see it if the question gets deleted since you're a `10k+` member. OP should have been using prepared statements along with using proper password hashing algos. — Funk Forty Niner, Jul 26 '14 at 01:34

score -1 · Answer 4 · answered Jul 22 '14 at 07:42

-1

$newaccount= "INSERT INTO users (name,password) VALUES ("$newusername","$newpassword")";

TO

$newaccount= "INSERT INTO users (name,password) VALUES ('".$newusername."','".$newpassword."')";

OR TO

$newaccount= "INSERT INTO users (name,password) VALUES ('$newusername','$newpassword')";

answered Jul 22 '14 at 07:42

iamawebgeek

2,713
1
18
34

See http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php?rq=1 – user2864740 Jul 26 '14 at 01:17

score -1 · Answer 5 · answered Jul 22 '14 at 07:46

<?php
    mysql_connect ("localhost","root","root");
    mysql_select_db ("new");
    $newusername=$_POST ['newusername'];
    $newpassword=$_POST ['newpassword'];
    $submit=$_POST ['submit'];
    if($submit) {
    $newaccount= "INSERT INTO users (name,password) VALUES ('".$newusername."', '".$newpassword."')";
    $result=mysql_query($newaccount);
    if ($result) {
    print "account has been created"."<meta http-equiv="refresh" content="5;login.php">";
    }
    else {
    echo " The account is already exist";
    }
    }
    ?>

See http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php?rq=1 — user2864740, Jul 26 '14 at 01:17

why is insert into not working

5 Answers5