Missing part of string while insert into mysql with PHP

Question

I have make a form with this code:

<form action="action.php" method="POST">
HTML:
<textarea name="html"></textarea>
<input type="submit">
</form>

and Insert it with php :

<?php
include "database.php";
$html = mysqli_real_escape_string($connect, $_POST['html']);
$insert = mysqli_query($connect, "INSERT INTO data VALUES('$html')");
?>

I have used that, and it successfully inserted to mysql, but some of my html string is missing Example: if i insert 2000 character of html, it just insert 250 character Note: I'm using jquery to post the form

$.ajax({
        url     : url_login,

        data    : 'html='+html, 

        type    : 'POST',

        dataType: 'html',

        success : function(mess){
            $('#content').html(mess);
        },
    });

Please help

Did you check the database field to make sure it allows more than 250 characters? — John Conde
– John Conde, Commented Aug 30, 2017 at 16:22
Why are you storing entire chunks of HTML data? (Yes, I know there are plenty of cases where this is fully valid, but this may be an XY problem) — GrumpyCrouton
– GrumpyCrouton, Commented Aug 30, 2017 at 16:25
WARNING: When using mysqli you should be using parameterized queries and bind_param to add user data to your query. DO NOT use manual escaping and string interpolation or concatenation to accomplish this because you will create severe SQL injection bugs. Accidentally unescaped data is a serious risk. Using bound parameters is less verbose and easier to review to check you’re doing it properly. — tadman
– tadman, Commented Aug 30, 2017 at 17:26

Script47 · Accepted Answer · 2017-08-30 17:28:08Z

1

You should follow the format as mentioned by jQuery AJAX documentation:

change,

data    : 'html='+html,

to,

data : { 
    html: html
}

The format that is being use is known as a object where you specify key/values (as many as you'd like).

Note

Seeing as you are using mysqli_* consider usng prepared statements to prevent SQL injection.
Validate your $_POST with isset and empty to ensure that the fields are set to prevent errors.

edited Aug 30, 2017 at 17:28

answered Aug 30, 2017 at 17:26

Script47

14.6k4 gold badges49 silver badges69 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

tadman Over a year ago

Not only is this easier to read, but it properly escapes the content in html.

Collectives™ on Stack Overflow

Missing part of string while insert into mysql with PHP

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related