Using a Submit Button to insert into a MySQL database via PHP?

Question

I'm new to PHP, so I don't know how to do this. I'm trying to insert an entry ( I think, I don't know how it's called yet ) to my database from another database through a "submit" button.

In my databse I have 2 tables. First table called "users"

id name         server  
1  Alexander      1 
2  Robert         2
3  Jack           1

Second one called "server" where I have these:

id   name
1    USA
2    EUROPE
3    GLOBAL

This is a part of my page where is the button:

<?php
define('TITLE', "Login");
include '../header.php';
check_verified();
?>

.
. some html code
.



<form class="form-auth" action="includes/europe.inc.php" method="post">
                            <?php insert_csrf_token(); ?>
                            <div class="text-center mb-3">
                    <small class="text-success font-weight-bold">
                        <?php
                            if (isset($_SESSION['STATUS']['joinstatus']))
                                echo $_SESSION['STATUS']['joinstatus'];

                        ?>
                    </small>
                </div>

. 
. some html code
.
<button class="btn btn-primary btn-lg" type="submit" value="joineurope" name='joineurope'>Join NOW!</button>
</form>

and here is the 'europe.inc.php':

<?php
session_start();

require '../../assets/includes/security_functions.php';
require '../../assets/includes/datacheck.php';
require '../../assets/includes/auth_functions.php';
check_logged_in();

if (isset($_POST['joineurope'])) {

      /*
    * -------------------------------------------------------------------------------
    *   Securing against Header Injection
    * -------------------------------------------------------------------------------
    */

    foreach($_POST as $key => $value){

        $_POST[$key] = _cleaninjections(trim($value));
    }

    require '../../assets/setup/db.inc.php';

     /*
        * -------------------------------------------------------------------------------
        *   User Joins
        * -------------------------------------------------------------------------------
        */

        $sql = "INSERT into users (server)
        values (select name from server where name='EUROPE')";
        $stmt = mysqli_stmt_init($conn);
        if (!mysqli_stmt_prepare($stmt, $sql)) {

            $_SESSION['ERRORS']['scripterror'] = 'SQL ERROR';
            header("Location: ../");
            exit();
            }   
                else {

    mysqli_stmt_bind_param($stmt, "s", $server); 
    mysqli_stmt_execute($stmt);
    mysqli_stmt_store_result($stmt);

    $_SESSION['STATUS']['joinstatus'] = 'Joined to EUROPE';
            header("Location: ../../");
            exit();
    }

    mysqli_stmt_close($stmt);
    mysqli_close($conn);
}
    
    else {

    header("Location: ../");
    exit();
}

I have 3 pages with "europe"/"usa" and "global". In each page I have a button called "join". I don't know how to insert data from each page. I mean when I'm at "europe" page and press the button "join", I want to insert in my table called "users" that specific name (or ID if you know how to do this) from table called "server". Now if I press the button join, it just refresh the page, but it doesn't insert anything in my database. Thank you and I'm sorry for my bad english. I hope you understand what I want.

Answer 1

You need to put the user ID into your query. And you should be using UPDATE to update the server column in the users table, you're not inserting a new row.

You can use a cross join to get the server ID from the servers table.

$stmt = $conn->prepare("
    UPDATE users AS u
    CROSS JOIN servers AS s
    SET u.server = s.id
    WHERE u.id = ? AND s.name = 'EUROPE'";
$stmt->bind_param("i", $_SESSION['id']);
$stmt->execute();

I've used the OO style of the API because it's more compact and readable IMHO. You can convert to the functional style if you really prefer, they're equivalent.