Couldn't enter the data to mysql using php

Question

It couldn't store the data to mysql. What to do? All variable and file name are correct.

     <?php
require 'connection.php';
$conn    = Connect();
$id    =$conn->real_escape_string ($_POST['id']);
$name    = $conn->real_escape_string ($_POST['name']);
$phone    = $conn->real_escape_string ($_POST['phone']);
$address    = $conn->real_escape_string ($_POST['address']);
$city    = $conn->real_escape_string ($_POST['city']);
$zip   = $conn->real_escape_string ($_POST['zip']);
$state    = $conn->real_escape_string ($_POST['state']);
$item    = $conn->real_escape_string ($_POST['item']);

$status    = $conn->real_escape_string ($_POST['status']);
$enquiry_date    = $conn->real_escape_string ($_POST['enquiry_date']);
$enquiry_user = $conn->real_escape_string ($_POST['enquiry_user']);
$query   = "INSERT into enquiry
           (id, name, phone, address, city, zip, state, item, status, enquiry_date, enquiry_user) 
           VALUES('" . $id . "','" . $name . "','" . $phone . "','" . $address . "','" . $city . "','" . $zip . "','" . $state . "','" . $item . "','" . $status . "','" . $enquiry_date . "')";
$success = $conn->query($query);



if (!$success) {
    die("Couldn't enter data: ".$conn->error);
}

echo "Thank You For Contacting Us <br>";

$conn->close();
?>

Using prepared statements would solve the job of escaping string and quotes — Rotimi, Sep 27 '17 at 21:24
@FelippeDuarte surely meant the response of `$conn->error()` — Jeff, Sep 27 '17 at 21:32
You're already using an API that supports **prepared statements** with bounded variable input, you should utilize parameterized queries with placeholders (prepared statements) to protect your database against [SQL-injection](http://stackoverflow.com/q/60174/)! Get started with [`mysqli::prepare()`](http://php.net/mysqli.prepare) and [`mysqli_stmt::bind_param()`](http://php.net/mysqli-stmt.bind-param). — Qirel, Sep 27 '17 at 21:38
Like already asked, does `$conn->error` give anything? Have you enabled PHP error reporting? — Qirel, Sep 27 '17 at 21:38
@MunnaKumar we will see once you've fixed the two I pointed out. — Jeff, Sep 27 '17 at 21:40
You seemingly forgot to add a value to `enquiry_user`. You have one more column than you do values. `$conn->error` would have told you about that. — Qirel, Sep 27 '17 at 21:41
@Jeff $conn function declared in another php page called connection.php — Munna Kumar, Sep 27 '17 at 21:44
Yes, we know where $conn is coming from. `echo $conn->error` gives you the information about the error you have (which @Qirel and I told you already) — Jeff, Sep 27 '17 at 21:47

score 1 · Accepted Answer · answered Sep 27 '17 at 22:08

1

As @Jeff said:

$query   = "INSERT into enquiry
       (id, name, phone, address, city, 
        zip, state, item, status, enquiry_date, enquiry_user) 
       VALUES('" . $id . "','" . $name . "','" . $phone . "','" . $address . "','" 
        . $city . "','" . $zip . "','" . $state . "','" . $item . "','" 
         $status . "','" . $enquiry_date . "','" . $enquiry_user . "')";

You were missing . "','" . $enquiry_user

answered Sep 27 '17 at 22:08

Jacques Amar

1,803
1
10
12

That semi-sort of fixes it. The real problem here is not using placeholder values. – tadman Sep 27 '17 at 22:31
@tadman I agree. But that requires a lesson and examples, and I follow Larry Wall's philosophy – Jacques Amar Sep 28 '17 at 02:22
Larry Wall didn't advocate leaving your code vulnerable to SQL injection exploits because of preventable mistakes. [DBM supports placeholder values](http://search.cpan.org/dist/DBI/lib/DBD/DBM.pm). – tadman Sep 28 '17 at 16:33
1

@tadman hahaha. No, but he did advocate that **I** be lazy and not do someone else work .. I **100% agree** with you that he needs to learn it. – Jacques Amar Sep 28 '17 at 17:32
@JacquesAmar [https://stackoverflow.com/questions/52343928/how-to-fetch-data-using-foreach-in-one-form-codeignter?sfb=2] can you help me in this code – Munna Kumar Sep 15 '18 at 11:05

Couldn't enter the data to mysql using php

1 Answers1