0

I am trying to post the value in my database's table which i have made in 000webhost phpmyadmin server.To post/check i am using the postman software. In postman software i am passing the key value pairs (in form-data selection and also tried to pass in x-www-form-urlencoded). But values getting added are null. not that i have pass in key value pairs.

And when i am passing without any key value pair it still adds the row with null values in my table. Please help to solve.. I making this api to use it in my android application.

Here in my php code:

confi.php: 

<?php
error_reporting(1);
$conn = mysqli_connect("localhost", "********", "******","id1536885_mydb");
?>

individualuser_details.php:

<?php

// Include confi.php
include_once('confi.php');

if($_SERVER['REQUEST_METHOD'] == "POST"){
    // Get data
    $name = isset($_POST['name']) ? mysqli_real_escape_string($_POST['name']) : "";
    $adhar = isset($_POST['adhar']) ? mysqli_real_escape_string($_POST['adhar']) : "";
    $email = isset($_POST['email']) ? mysqli_real_escape_string($_POST['email']) : "";
    $password = isset($_POST['password']) ? mysqli_real_escape_string($_POST['password']) : "";
    $contact = isset($_POST['contact']) ? mysqli_real_escape_string($_POST['contact']) : "";
    $status = isset($_POST['status']) ? mysqli_real_escape_string($_POST['status']) : "";
//echo $name.' no';
    // Insert data into data base
    $sql ="INSERT INTO id1536885_mydb.`individualuser_details` (`ID`, `name`, `adhar`, `email`, `password`, `contact`, `status`) VALUES (NULL, '$name', '$adhar', '$email', '$password', '$contact', '$status');"; 
//  echo $sql;
    $qur = mysqli_query($conn,$sql);
    if($qur){
        $json = array("status" => 1, "msg" => "Done User added!");
    }else{
        $json = array("status" => 0, "msg" => "Error adding user!");
    }
}else{
    $json = array("status" => 0, "msg" => "Request method not accepted");
}

@mysqli_close($conn);

/* Output header */
    header('Content-type: application/json');
    echo json_encode($json);


?>
dev
  • 69
  • 8
  • 1
    You are wide open for SQL injection. Since you're using mysqli, take advantage of [prepared statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) and [bind_param](http://php.net/manual/en/mysqli-stmt.bind-param.php). You won't need to use mysqli_real_escape_string, since it bypasses all of those pesky quoting issues. – aynber May 04 '17 at 14:35
  • all your `mysqli_real_escape_string()` are faling and `mysqli_error($conn)` would have told you about it, but you chose not to check for errors. – Funk Forty Niner May 04 '17 at 14:36
  • error_reporting should have told you that `mysqli_real_escape_string` requires 2 parameters (link & string). – ccKep May 04 '17 at 14:37
  • its done.thank you. – dev May 04 '17 at 15:31

0 Answers0