PHP Prepared statement insert into database

Question

Does anyone see anything that is wrong with this. It isn't posting to database at all. There is a basic form asking for name and address on the page. But after submitting the form it just goes to a blank page.

Here is my code. There is stuff above this that reaches out to an API to validate the address data and declares the variables. The dedup part of the code is working in case that matters.

if(empty($errorMessage)) 
    {
        // Dedupe the entry into the form 
        $dupesql = "SELECT * FROM formData WHERE (name = '$full_name' AND address = '$primary_number' AND city = '$city_name' AND state = '$state_abbreviation' AND zip = '$zipcode_full' )";
        $duperaw = $mysqli->query($dupesql);
        if($duperaw->num_rows > 0) {
            $dupe .= "$full_name already exists on $primary_number \n";
        } 
        else {

        $sql = "INSERT INTO formData(name, address, city, state, zip, date) VALUES (?, ?, ?, ?, ?, ?)";
        $stmt = $mysqli->prepare($sql);
        $stmt->bind_param("ssssss", $full_name, $primary_number, $city_name, $state_abbreviation, $zipcode_full, $date);
        $stmt->execute(); 

        header("location: index.php?success=1");
        exit();
        }
    }

I have also tried using a query instead of a prepared statement but this just gives the success message and doesnt post to the DB

$sql = "INSERT INTO fromData (name, address, city, state, zip, date) VALUES (".
                $full_name . ", " .
                $primary_number . ", " .
                $city_name . ", " .
                $state_abbreviation . ", " .
                $zipcode_full . ", " .
                $date . ")";
$mysqli->query($sql);

Any help would be great!

You're only getting a "success" message with the raw query because you're not dying on errors. Without the quotes around the values, you're almost certain to have broken SQL syntax. — cHao
– cHao, Commented Dec 12, 2013 at 21:35
You seem to be using two table names: data and formData (and fromData...), is that correct or just a typo? By the way, you should add proper error handling to your database calls. — jeroen
– jeroen, Commented Dec 12, 2013 at 21:40
If you don't redirect and echo $mysqli->error, does it return an error? — afuzzyllama
– afuzzyllama, Commented Dec 12, 2013 at 21:46

Mr Coder · Accepted Answer · 2013-12-13 13:49:49Z

1

Try this SQL

 $sql = "INSERT INTO fromData (name, address, city, state, zip, date) VALUES ('$full_name', '$primary_number', '$city_name', '$state_abbreviation', '$zipcode_full', '$date')";
 $mysqli->query($sql);

cHao was hinting towards it

answered Dec 13, 2013 at 13:49

Mr Coder

512 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Álvaro González Over a year ago

Dropping prepared statements and opening your site to SQL injection attacks is not a proper fix. What's next? Go back to the deprecated mysql extension and enable register globals?

Travis Over a year ago

@ÁlvaroG.Vicario if prepared statement is better i would love to use it but i am not sure how to make it work, any guidance would be appreciated.

Álvaro González Over a year ago

@Travis - You are already using them in your code, aren't you?

Travis Over a year ago

@ÁlvaroG.Vicario I was trying to but i couldn't get it to work. Then i accepted the other answer because it does work but i don't want to be susceptible to SQL Injection. Do you see anything above with my Prepared Statement that looks off to you?

Collectives™ on Stack Overflow

PHP Prepared statement insert into database

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related