Fail input to database mysql

Question

I Want to ask about input data to database.

  <?php
  include "koneksi.php";
  if(isset($_POST['daftar'])){
    $daftar = mysqli_query($conn, "INSERT INTO tb_daftar VALUES
    ('".$_POST['id']."',
      '".$_POST['nama']."',
      '".$_POST['asal_sekolah']."',
      '".$_POST['jenis_kelamin']."',
      '".$_POST['nama_ayah']."',
      '".$_POST['nama_ibu']."',
      '".$_POST['alamat']."',
      '".$_POST['no_hp']."',
      '')");
      if($daftar){
        $pesan1 = "Berhasil daftar";
        echo "<script type='text/javascript'>alert('$pesan1');</script>";
      }else{
        $pesan2 = "Gagal daftar";
        echo "<script type='text/javascript'>alert('$pesan2');</script>";
      }
  }
 ?>

That result always show " Gagal daftar ".. How to fix it? Thanks!

@SimoneNigro No he can't. Please check again, its '".$_POST['no_hp']."', ' ') — Amit Gupta, Dec 23 '17 at 11:10
@AmitGupta He's correct. It would be much easier to see if the OP used a prepared statement. — Barmar, Dec 23 '17 at 11:12
Check error? Hmm... no error. I've change to mysqli_error($conn); then just refreshed the index.php reset the text box — Rafi Priatna Kasbiantoro, Dec 23 '17 at 11:16
One thing I always do is to list the columns I'm inserting into, this helps in debugging and checking that I'm inserting the right value into the right column. — Nigel Ren, Dec 23 '17 at 11:20

score 0 · Accepted Answer · edited Dec 23 '17 at 11:20

0

You have an extra comma after the last value. You should also use a prepared statement to prevent SQL injection.

if ($dafter = mysqli_prepare($conn, "INSERT INTO tb_dafter VALUES (?, ?, ?, ?, ?, ?, ?, ?)")) {
    mysqli_stmt_bind_param($dafter, "ssssssss", $_POST['id'], $_POST['nama'], $_POST['asal_sekolah'], $_POST['jenis_kelamin'], $_POST['nama_ayah'], $_POST['nama_ibu'], $_POST['alamat'], $_POST['no_hp']);
    mysqli_stmt_execute($dafter);
    $pesan1 = "Berhasil daftar";
    echo "<script type='text/javascript'>alert('$pesan1');</script>";
} else {
    $pesan2 = htmlentities(mysqli_error($conn));
    echo "<script type='text/javascript'>alert('$pesan2');</script>";
}

edited Dec 23 '17 at 11:20

Simone Nigro

4,717
2
37
72

answered Dec 23 '17 at 11:19

Barmar

741,623
53
500
612

What is "sssssss" ? – Rafi Priatna Kasbiantoro Dec 23 '17 at 12:00
The list of parameter types. `s` = string, `i` = integer. Did you try reading the documentation? – Barmar Dec 23 '17 at 12:04

score -1 · Answer 2 · answered Dec 23 '17 at 11:19

Your code is not in good condition, You need to think in many aspect like,

Integer value like id will not be in quotes.
Sequence matter if you not provided column names with table name, Highly risky without column name.
You query is easy to Inject, SQL Injection
You have not check $_POST variable value, with isset, Check my other answer about this

To cover your risk use mysqli or pdo

But I suggest to insert use mysqli or pdo. Here are some link to learn about mysqli:

mysqli_prepare

mysqli_stmt_bind_param

Prepared Statements in MySQLi

Consider moving to codereview.stackexchange.com where this kind of answers are welcome. On Stack Overflow, however, a general musing on the code posted is off topic — Your Common Sense, Dec 23 '17 at 11:23

JoshKisb · Answer 3 · 2017-12-23T12:03:36.703

-2

View errors from mysql query using mysqli_error

else{
    $pesan2 = mysqli_error($conn);
    echo "<script type='text/javascript'>alert('Error: '+$pesan2);</script>";
  }

edited Dec 23 '17 at 12:03

answered Dec 23 '17 at 11:12

JoshKisb

742
7
9

1

It is a solution since he needs to find out what is the cause of the data not being inserted to database – JoshKisb Dec 23 '17 at 11:14
A debugging step answers how to fix a problem even if it is only a first step – JoshKisb Dec 23 '17 at 11:19
Nothing error showing, the page just refreshed here my form code : https://pastebin.com/jNsnmVFq – Rafi Priatna Kasbiantoro Dec 23 '17 at 11:20
@RafiPriatnaKasbiantoro is the original code with `if(isset($_POST['daftar'])){` on the same page – JoshKisb Dec 23 '17 at 11:24
@JoshKisb Yes, i just have 2 files it's koneksi.php and index.php. – Rafi Priatna Kasbiantoro Dec 23 '17 at 11:30
oh first try changing `Daftar` to `daftar` in submit input alue – JoshKisb Dec 23 '17 at 11:32
Well, nothing happen... – Rafi Priatna Kasbiantoro Dec 23 '17 at 11:54
Let us [continue this discussion in chat](http://chat.stackoverflow.com/rooms/161856/discussion-between-joshkisb-and-rafi-priatna-kasbiantoro). – JoshKisb Dec 23 '17 at 12:03
It's a good answer, but this particular way to report errors is flawed anyway. – Your Common Sense Dec 23 '17 at 12:36

score -3 · Answer 4 · answered Dec 23 '17 at 11:23

-3

 $daftar = mysqli_query($conn, "INSERT INTO tb_daftar((database columns)) 
  VALUES
('".$_POST['id']."',
  '".$_POST['nama']."',
  '".$_POST['asal_sekolah']."',
  '".$_POST['jenis_kelamin']."',
  '".$_POST['nama_ayah']."',
  '".$_POST['nama_ibu']."',
  '".$_POST['alamat']."',
  '".$_POST['no_hp']."',
  '')");

answered Dec 23 '17 at 11:23

kadir

64
4

Missing colon information when saving the database. (database columns) should be entered in order of the data colon. – kadir Dec 23 '17 at 15:14

Fail input to database mysql

4 Answers4