php and my sql HELP PLEASEEEEE

[robdj12139]

I'm trying to add entries to my MySQL database using php and entry fields to add edit and change values inside of my MySQL database. for some reason it isn't erroring out but it isn't posting it either. help

 

[Zubair]

Hello,

This is not the right section to post this request. Free Hosting forum is for support related to hosting account issues.

***Moved to Programming help***

 

[descalzo]

If you post the code (use ****** for passwords, etc) it might be easier to suggest a solution. Please post the code between PHP or CODE tags.

 

[misson]

Just make sure you don't dump the entirety of your code. A code sample should be complete yet concise and representative of the actual code.

Also, no need to shout in the thread title or elsewhere. It conveys no useful information.

 

[robdj12139]

added.php
ASCII English text
<a href="index.php">Back to List</a>
<?php
/// In order to use this script freely
/// you must leave the following copyright
/// information in this file:
/// Copyright 2006 www.turningturnip.co.uk
/// All rights reserved.

include("connect.php");
$clan = trim($_POST['clan']);
$a = trim($_POST['a']);
$b = trim($_POST['b']);
$c = trim($_POST['c']);
$d = trim($_POST['d']);
$e = trim($_POST['e']);
$f = trim($_POST['f']);
$g = trim($_POST['g']);
$h = trim($_POST['h']);
$j = trim($_POST['j']);
$k = trim($_POST['k']);
$l = trim($_POST['l']);
$m = trim($_POST['m']);
$n = trim($_POST['n']);
$o = trim($_POST['o']);
$p = trim($_POST['p']);
$q = trim($_POST['q']);
$r = trim($_POST['r']);
$s = trim($_POST['s']);
$t = trim($_POST['t']);

$query = "INSERT INTO vita (id, clan, a, b, c, d, e, f, g, h, j, k, l, m, n, o, p, q, r, s, t)
VALUES ('', '$clan', '$a', '$b', '$c', '$d', '$e', '$f', '$g', '$h', '$j', '$k', '$l', '$m', '$n', '$o', '$p', '$q', '$r', '$s', '$t')";
$results = mysql_query($query);

if ($results)
{
echo "Details added.";
}
mysql_close();
?>
and here is my connect.php
<?php
/// For the following details,
/// please contact your server vendor

$hostname='localhost'; //// specify host, i.e. 'localhost'
$user='th3dj_admin'; //// specify username
$pass='******'; //// specify password
$dbase='th3dj_hud'; //// specify database name
$connection = mysql_connect("$hostname" , "$user" , "$pass")
or die ("Can't connect to MySQL");
$db = mysql_select_db($dbase , $connection) or die ("Can't select database.");

 

[misson]

Please use

, [html] or [code] tags (as appropriate) to separate and format code.

The sample code is vulnerable to [url=http://unixwiz.net/techtips/sql-injection.html]SQL injection[/url], which is a very serious [url=http://bobby-tables.com/]security risk[/url]. To fix this hole, switch from the outdated [URL="http://x10hosting.com/forums/programming-help/162529-php-begin-deprecation-ext-mysql-start-moving-your-development-pdo-now.html"]mysql extension[/URL] to [URL=http://php.net/PDO]PDO[/URL] and use [URL=http://www.php.net/PDO.prepared-statements]prepared statements[/URL]. If you need a PDO tutorial, try "[URL=http://www.kitebird.com/articles/php-pdo.html]Writing MySQL Scripts with PHP and PDO[/URL]". The site you save may just be your own.

[URL="http://www.phpfreaks.com/blog/or-die-must-die"]Don't use [FONT="Courier New"]die[/FONT][/URL] when outputting HTML.

[URL="http://c2.com/cgi/wiki?GlobalVariablesAreBad"]Globals[/URL] are bad. Your DB connection script should provide functions or (better yet) a class to manage the DB connection and segregate the credentials. You can use static [URL="http://www.php.net/manual/en/language.variables.scope.php#language.variables.scope.static"]variables[/URL] and [URL="http://php.net/static"]properties[/URL] to store the connection so subsequent calls to the connect function don't have to recreate it. See "[URL="http://forums.x10hosting.com/programming-help/99888-please-help-myphpadmin-3.html#post564957"]Display all that would be secret while Mysql is broken[/URL]" and "[URL="http://x10hosting.com/forums/tutorials/12014-php-mysql-php-4.html#post613750"][PHP] MySQL and PHP[/URL]" for some illustrative examples.

When you say "it isn't erroring out but it isn't posting it either", do you mean you don't see "Details added." in the output? If [c]$results[/c] is false, does the actual script fetch the database error (with the outdated mysql extension, you'd use [url=http://php.net/mysql_error][c]mysql_error[/c][/url])? If not, get it an tell us what it is. A script won't output database errors on its own (unless you're using a DB extension that uses exceptions and don't catch the exception, but that's not so much due to the database error as it is the exception). Note that scripts should show database [URL="http://msdn.microsoft.com/en-us/library/ms995351.aspx#securityerrormessages_topic2"]error messages[/URL] only admins.

Are the single-character column names just for the sample, or is that what you use in your actual database?

 

[robdj12139]

pdo sounds like a much easier way to actually do what i need it to..... i think that might be able to get it all set up for me and everything. ill read thru it and find out. i might actually try to do the whole thing considering that mostly what i need it to do is read from the database and display the results so they can be parsed for a game that i play...