HTML form to PHP server access denied

Question

Trying to make connection between html form and sql database

I am new to coding and stuff. I have copied script and trying to figure them out.

the code works with wampp server, just doesn't work with real hostgator server. i know it could be from the hostgator's end that the script is not working. I'm just unable to to access the database, pass and username are absolutely correct.

my website: sqms.in

contact form: sqms.in/contactus.html

PHP CODE:

define('DB_NAME', 'contactus');
define('DB_USER', 'sqmsihv7_admin');
define('DB_PASSWORD', '*******');
define('DB_HOST', 'localhost:3306');

$link = mysql_connect(DB_HOST, DB_USER, DB_PASSWORD);

if (!$link) {
   die('Could not connect: ' . mysql_error());
   }

  $db_selected = mysql_select_db(DB_NAME, $link);

  if (!$db_selected) {
  die('Can\'t use ' . DB_NAME . ': ' . mysql_error());
  }

  $value = $_POST['name'];
  $value2 = $_POST['email'];
  $value3 = $_POST['gender'];
  $value4 = $_POST['message'];


  $sql = "INSERT INTO tb_cform (name, email, gender, message) VALUES  ('$value', '$value2', 
  '$value3', '$value4')";
  mysql_query($sql);

  mysql_close();

HTML CODE:

<div class="row">
                    <form action="connection2.php" method="post">
                        <div class="col-md-6">
                            <div class="form-group">
                                <label for="name" class="sr-only">Email</label>
                                <input placeholder="Name" name="name" type="text" class="form-control input-lg">
                            </div>  
                        </div>
                        <div class="col-md-6">
                            <div class="form-group">
                                <label for="email" class="sr-only">Email</label>
                                <input placeholder="Email" name="email" type="text" class="form-control input-lg">
                            </div>  
                        </div>
                        <div class="col-md-12">
                            <div class="form-group">
                                <label for="gender" class="sr-only">Gender</label>
                                <select class="form-control input-lg" name="gender">
                                  <option>--Gender--</option>
                                  <option>Male</option>
                                  <option>Female</option>
                                </select>
                            </div>  
                        </div>
                        <div class="col-md-12">
                            <div class="form-group">
                                <label for="message" class="sr-only">Message</label>
                                <textarea placeholder="Message" name="message" class="form-control input-lg" rows="3"></textarea>
                            </div>  
                        </div>
                        <div class="col-md-6">
                            <div class="form-group">
                                <input type="submit" class="btn btn-primary " value="Send">

                                <input type="reset" class="btn btn-outline  " value="Reset">
                            </div>  
                        </div>
                    </form> 
                </div>

strong text

Answer 1

<?php
define('DB_NAME', 'contactus');
define('DB_USER', 'sqmsihv7_admin');
define('DB_PASSWORD', '*******');
define('DB_HOST', 'localhost:3306');


// Create connection
$conn = new mysqli(DB_NAME, DB_USER, DB_PASSWORD, DB_HOST);
// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
} 

$value = $_POST['name'];
$value2 = $_POST['email'];
$value3 = $_POST['gender'];
$value4 = $_POST['message'];

$sql = "INSERT INTO tb_cform (name, email, gender, message) VALUES  ('$value', '$value2', 
  '$value3', '$value4')";

if ($conn->query($sql) === TRUE) {
    echo "New record created successfully";
} else {
    echo "Error: " . $sql . "<br>" . $conn->error;
}

$conn->close();
?>

Try this for your php file it should work just fine (If your form works correctly) and your Database exists

Dont forget to put your real DB_PASSWORD when you copy my code

Answer 2

Since you are using hostgator as the hosting provider. Your MySQL database and username are always in the format : YOUR-HOSTGATOR-USERNAME_your-database, YOUR-HOSTGATOR-USERNAME_your-username

In the above code, just replace

define('DB_NAME', 'contactus');
define('DB_USER', 'sqmsihv7_admin');
define('DB_PASSWORD', '*******');
define('DB_HOST', 'localhost:3306');

with

define('DB_NAME', 'sqmsihv7_contactus');
define('DB_USER', 'sqmsihv7_admin');
define('DB_PASSWORD', '*******');
define('DB_HOST', 'localhost:3306');

as your username on hostgator is sqmsihv7

After this everything will work properly.

Answer 3

the code works with wampp server - this is bad, because the code should NOT work on any modern development setup, and indicates that you are still on PHP5. all new development should happen on PHP 7+ (as of writing, php 7.1.8 is optimal). so the first thing you should do, is to update your wampp server (link to wamp with php 7.1.7 is here: https://bitnami.com/redirect/to/153294/bitnami-wampstack-7.1.7-0-dev-windows-x64-installer.exe )

just doesn't work with real hostgator server - that's hopefully because the host server has been updated to php7 already. but somewhere, there is a php error log, you should find that log and check it in any case. (if phpinfo() don't say where it is, ask your hosters customer support)

you see, in PHP7, the mysql_ api is removed. (although there is a mysql_ backport for legacy code compatibility available ), and in PHP7 you must decide between the MySQLi api (which itself is very close to the mysql_ api), and PDO (my personal favorite).

your second problem, is that you don't escape your sql inputs, so you're vulnerable to hacker's SQL Injection attacks. for example, if a hacker sets the message to goodbye db'); DROP TABLE contactus; -- , the hacker will delete your entire database!

your code ported to PDO (which is both PHP5 and PHP7 compatible), and fixing the SQL injection vulnerabilities, would roughly look like this:

define('DB_NAME', 'contactus');
define('DB_USER', 'sqmsihv7_admin');
define('DB_PASSWORD', '*******');
define('DB_HOST', 'localhost');
define('DB_PORT',3306);

// $link = mysql_connect ( DB_HOST, DB_USER, DB_PASSWORD );
$db = new PDO ( 'mysql:host=' . DB_HOST . ';port='. DB_PORT .';dbname=' . DB_NAME . ';charset=utf8mb4', DB_USER, DB_PASSWORD, array (
        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION 
) );
// if (! $link) {
// die ( 'Could not connect: ' . mysql_error () );
// }
// $db_selected = mysql_select_db ( DB_NAME, $link );
// if (! $db_selected) {
// die ( 'Can\'t use ' . DB_NAME . ': ' . mysql_error () );
// }

$value = $db->quote ( $_POST ['name'] );
$value2 = $db->quote ( $_POST ['email'] );
$value3 = $db->quote ( $_POST ['gender'] );
$value4 = $db->quote ( $_POST ['message'] );

$sql = "INSERT INTO tb_cform (name, email, gender, message) VALUES  ($value, $value2,
  $value3, $value4)";
$db->query ( $sql );
// mysql_query ( $sql );

// mysql_close ();

(note that i recommend using prepared statements instead of quoted strings, but learning that is just a google search away - an excellent tutorial explaining both prepared queries, and the difference between mysql_ and PDO, is here http://wiki.hashphp.org/PDO_Tutorial_for_MySQL_Developers )

edit: noticed that you specified the port in the host, that probably doesn't work with PDO, so i updated the code to use the port= parameter and a new DB_PORT define.