PHP won't insert into MySQL, no error

Question

$sql = "INSERT INTO $table_name VALUES
('$_POST[firstname]', '$_POST[lastname]', '$_POST[username]', password('$_POST[password]'), 'Users', '', '', '$pchange', 
'$_POST[email]', '$default_url', '$verify', '', 0, '', 0)";

$result = @mysql_query($sql,$connection) or die(mysql_error());

$sql, $connection and $table_name are all valid and are used previously in the script and the database, this is how my database looks like:

firstname   varchar(20) latin1_swedish_ci       Yes NULL          Change      Drop   More 
lastname    varchar(20) latin1_swedish_ci       Yes NULL          Change      Drop   More 
username    varchar(20) latin1_swedish_ci       Yes NULL          Change      Drop   More 
password    varchar(50) latin1_swedish_ci       Yes NULL          Change      Drop   More 
group1      varchar(20) latin1_swedish_ci       Yes NULL          Change      Drop   More 
group2      varchar(20) latin1_swedish_ci       Yes NULL          Change      Drop   More 
group3      varchar(20) latin1_swedish_ci       Yes NULL          Change      Drop   More 
pchange     varchar(1)  latin1_swedish_ci       Yes NULL          Change      Drop   More 
email       varchar(100)latin1_swedish_ci       Yes NULL          Change      Drop   More 
redirect    varchar(100)latin1_swedish_ci       Yes NULL          Change      Drop   More 
verified    varchar(1)  latin1_swedish_ci       Yes NULL          Change      Drop   More 
last_login  date                                Yes NULL          Change      Drop   More 
balance     double      UNSIGNED                Yes 0             Change      Drop   More 
address     varchar(60) latin1_swedish_ci       Yes NULL          Change      Drop   More 
lostbalance double                              Yes 0             Change      Drop   More

Thanks in advance.

Don't use error suppressing operator if you want to see what's wrong. — N.B.
– N.B., Commented May 10, 2012 at 13:37
Also, don't just blindly insert $_POST variables into your mysql queries. Either mysql_real_escape them before or use prepared statements (PDO is great for this too). — Kep
– Kep, Commented May 10, 2012 at 13:40
I used if(!cleanQuery($_POST['username'])==$_POST['username']) before that — Madmadmax
– Madmadmax, Commented May 10, 2012 at 16:37

Adam · Accepted Answer · 2012-05-10 13:49:01Z

4

No error because of @:

@mysql_query($sql,$connection) or die(mysql_error());

The @ suppresses the errors from the mysql_query() function.

I see multiple errors in your statements:

'$_POST[firstname]'- is suppossed to be $_POST['firstname']. Store the value in a variable or use concatenation: "'.$_POST['firstname'].'"
Use mysql_query($sql) or die(mysql_error());
Escape all the data you are storing in the db.

edited May 10, 2012 at 13:49

answered May 10, 2012 at 13:38

Adam

1,69414 silver badges18 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Kep Over a year ago

To further comment on this, read: Why is $foo[bar] wrong? (Search for it on the page, it doesn't provide a direct link to that paragraph)

gen_Eric Over a year ago

"$_POST[firstname]" is correct. php.net/manual/en/…

Bud Damyanov · Accepted Answer · 2012-05-10 13:40:30Z

1

First of all, it is not good security practice to leave any user input unfiltered, because soon you will be victim of SQL injection and/or XSS attacks. You should filter your user input this way:

$var = filter_var($_POST['var']), FILTER_SANITIZE_STRING);

Then you should use this $var in your SQL query, instead of directly using the $_POST['var']. i.e.:

$sql = "INSERT INTO $table_name VALUES
('$firstname', '$lastname', '$username', password('$password'), 'Users', '', '', '$pchange', 
'$email', '$default_url', '$verify', '', 0, '', 0)";

answered May 10, 2012 at 13:40

Bud Damyanov

32.1k7 gold badges47 silver badges53 bronze badges

Comments

djot · Accepted Answer · 2012-05-10 13:37:01Z

-2

You have to name the table columns in front of "VALUES"

INSERT INTO $table_name (field_1, field2, ...) VALUES ($_POST_1, ...)

answered May 10, 2012 at 13:37

djot

2,9474 gold badges21 silver badges28 bronze badges

1 Comment

SeanCannon Over a year ago

Only if the provided value count doesn't match the column count.

Collectives™ on Stack Overflow

PHP won't insert into MySQL, no error

3 Answers 3

2 Comments

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related