0

I was facing some problems with my database code. I used an insert query to insert my data from the form into my database called "wstorage". Only this method didn't work when I used the usual query " INSERT INTO users (nom, Prenom,..) VALUES ('$nom', '$Prenom'..).

In fact, the query did work but nothing showed on my database. Then I used another query where I call for the second time the name of my database 'wstorage'(the first time being in the session start and connection) and suddenly it works.

My question is : Why does it work when I normally don't have to call my database in the insert query?

This is my server.php code :

<?php 
session_start();

$db = mysqli_connect('localhost','root','','wstorage');

if (mysqli_connect_errno()) {
echo 'Failled to connect to MYSQL: '.$mysqli_connect_errno();
  }


// REGISTER USER
if (isset($_POST['registeruser'])) {
    // receive all input values from the form
    $nom = mysqli_real_escape_string($db, $_POST['nom']);
    $Prenom = mysqli_real_escape_string($db, $_POST['Prenom']);
    $Situation = mysqli_real_escape_string($db, $_POST['Situation']);
    $sex = mysqli_real_escape_string($db, $_POST['sex']);
    $email = mysqli_real_escape_string($db, $_POST['email']);
    $Nombre_Livre = mysqli_real_escape_string($db, $_POST['Nombre_Livre']);
    $Nombre_Media = mysqli_real_escape_string($db, $_POST['Nombre_Media']);
    $Nombre_Recidives = mysqli_real_escape_string($db, $_POST['Nombre_Recidives']);
    $Etat_Abon = mysqli_real_escape_string($db, $_POST['Etat_Abon']);
    $Penalite = mysqli_real_escape_string($db, $_POST['Penalite']);
    $Etat_Penalite = mysqli_real_escape_string($db, $_POST['Etat_Penalite']);
    $Numero = mysqli_real_escape_string($db, $_POST['Numero']);

        $query = "INSERT INTO `wstorage`.`users` (`nom`, `Prenom`, `Situation`, `sex`, `email`, `Numero`, `Nombre_Livre`, `Nombre_Media`, `Nombre_Recidives`, `Etat_Abon`, `Penalite`, `Etat_Penalite`, `date`) VALUES ('$nom', '$Prenom', '$Situation', '$sex', '$email', '$Numero', '$Nombre_Livre', '$Nombre_Media', '$Nombre_Media', '$Etat_Abon', '$Penalite', '$Etat_Penalite', CURRENT_TIMESTAMP)";

        mysqli_query($db, $query);

if($query) {

    echo "success";
} else {

    echo " Fail";
    }

}
?>
Funk Forty Niner
  • 74,450
  • 15
  • 68
  • 141
Ahlam Zaidane
  • 9
  • 2
  • 2
    `if($query)` will always return true. You are not storing the result of `mysqli_query` call and checking against that. – Madhur Bhaiya Nov 26 '18 at 10:08
  • 2
    On another note, you can get rid of all the `escape_string()` call by using [Prepared Statements](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) – Madhur Bhaiya Nov 26 '18 at 10:09
  • okay but now when i check my database, the data i entered are well stored in 'wstorage'. Is there a way to store my result without calling the database's name in INSERT INTO query? – Ahlam Zaidane Nov 26 '18 at 10:11
  • *Then I used another query* Would you show us the second query? – Cid Nov 26 '18 at 10:11
  • This has nothing to do with your problem, but I noticed that : `INSERT INTO ... Nombre_Media, Nombre_Recidives ... '$Nombre_Media', '$Nombre_Media' ...` – Cid Nov 26 '18 at 10:14
  • The seconde query is the one showed on my code where I used "INSERT INTO `wstorage`.`users` (`nom`, `Prenom`, `Situation`, `sex`, `email`, `Numero`, `Nombre_Livre`, `Nombre_Media`, `Nombre_Recidives`, `Etat_Abon`, `Penalite`, `Etat_Penalite`, `date`) VALUES ('$nom', '$Prenom', '$Situation', '$sex', '$email', '$Numero', '$Nombre_Livre', '$Nombre_Media', '$Nombre_Media', '$Etat_Abon', '$Penalite', '$Etat_Penalite', CURRENT_TIMESTAMP)"; – Ahlam Zaidane Nov 26 '18 at 10:14
  • I want to understand why did I have to call wstorage in my insert query? – Ahlam Zaidane Nov 26 '18 at 10:15
  • Thanks Cid for the notice, I changed it. – Ahlam Zaidane Nov 26 '18 at 10:16
  • @AhlamZaidane so, what is the first query that doesn't work? – Cid Nov 26 '18 at 10:26
  • It was the usual one I used in other apps : INSERT INTO users (nom, Prenom, Situation, sex, email, Numero, Nombre_Livre, Nombre_Media, Nombre_Recidives, Etat_Abon, Penalite, Etat_Penalite, date) VALUES ('$nom', '$Prenom', '$Situation', '$sex', '$email', '$Numero', '$Nombre_Livre', '$Nombre_Media', '$Nombre_Media', '$Etat_Abon', '$Penalite', '$Etat_Penalite', CURRENT_TIMESTAMP)"; – Ahlam Zaidane Nov 26 '18 at 10:29
  • `INSERT INTO ... date) ...` may fail. `date` is a SQL keyword and needs to be escaped with backticks ` – Cid Nov 26 '18 at 10:32
  • Actually in my previous code, i didn't even insert 'date' even if it was in my database. I'm not even calling it in in my inputs as you can see in server.php . I only added 'date' when everything worked. – Ahlam Zaidane Nov 26 '18 at 10:34

0 Answers0