Field not being inserted into mysql database from php

Question

I have a little problem where a field is not being inserted into my users table. I have two tables as follows:

users - id, gamerid, email, password, country, country_code countries - country_id, country, country_code

Now i have a signup form that comprises of gamerid,email,password and a country select (pulls from the countries table using php)

My problem is that when i submit the form, i want to run a query to pull the country code from the table which matches what was selected by the user and insert these fields into the users table. All my data is inserting correctly except for the country_code.

Here is my code for the html select section:

    <select name = "country_create" style = "height: 25px; width: 180px;">
    <option value="0" selected="selected" class =  "signup_form_country_select_class">Select your country</option>
    <?php
        include "config.php";

        $connection = mysql_connect($host, $username, $password) or die(mysql_error());
        mysql_select_db($dbname, $connection) or die(mysql_error());

        $result = mysql_query('SELECT country FROM countries');

        while($row = mysql_fetch_array($result))
        {
            echo '<option value="'.$row['country'].'">'.$row['country'].'</option>';
        }
    ?>
</select>

And here is the php from the register script:

    $connection = mysql_connect($host, $username, $password) or die(mysql_error());
mysql_select_db($dbname, $connection) or die(mysql_error());

// INPUT CLEANING FUNCTION
function clean($str)
{
    $cleaned = mysql_real_escape_string(strip_tags($str));
    return $cleaned;
}

$gamerid = clean($_POST['gamerid_create']);
$email = clean($_POST['email_create']);
$password = clean($_POST['password_create']);
$country = ($_POST['country_create']);

$cc_qry = "SELECT country_code FROM countries WHERE country = '$country'";
$country_code = mysql_query($cc_qry);

$insert = "insert into users(gamerid,email,password,country,country_code) values('$gamerid','$email','$password','$country','$country_code')";                    
mysql_query($insert, $connection);

Thanks in advance guys!

$country_code = mysql_query($cc_qry); This is not what you think it is, its a resource — user557846
– user557846, Commented Oct 29, 2012 at 19:43
Your clean() function is fine but you need to use it for ALL values that go to the database. As is you have SQL Injection vulnerabilities. Even better use placeholders in PDO. — Cfreak
– Cfreak, Commented Oct 29, 2012 at 19:45

Alvar FinSoft Soome · Accepted Answer · 2012-10-29 19:43:54Z

5

First - use PDO or mysqli functions, but secondly - you must also fetch data from query result:

$res = mysql_query($cc_qry);
$res_cc = mysql_fetch_assoc($res);
$country_code = $res_cc['country_code'];

answered Oct 29, 2012 at 19:43

Alvar FinSoft Soome

7405 silver badges11 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Field not being inserted into mysql database from php

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related