PHP Prepared statements from web form issues [duplicate]

Question

Only recently started using mysql so I'm slowly getting to grips with it, but trying to use PHP prepared statements for a webform, and upon submitting the webform, it's just displaying the php code. Any suggestions?

Thanks

<?php

$link = mysqli_connect("localhost", "root", "", "contactform");

if($link === false){
die("ERROR: Could not connect. " . mysqli_connect_error());
}

$sql = "INSERT INTO contactform (firstname, surname, address1, address2, 
towncity, county, postcode) VALUES (?,?,?,?,?,?,?)";

if($stmt = mysqli_prepare($link, $sql)){
mysqli_stmt_bind_param($stmt, "sssssss", $firstname, $surname, $address1, 
$address2, $towncity, $county, $postcode);

$firstname = $_REQUEST['firstname'];
$surname = $_REQUEST['surname'];
$address1 = $_REQUEST['address1'];
$address2 = $_REQUEST['address2'];
$towncity = $_REQUEST['towncity'];
$county = $_REQUEST['county'];
$postcode = $_REQUEST['postcode'];


if(mysqli_stmt_execute($stmt)){
    echo "Records inserted successfully.";
} else{
    echo "ERROR: Could not execute query: $sql. " . mysqli_error($link);
}
} else{
echo "ERROR: Could not prepare query: $sql. " . mysqli_error($link);
}

mysqli_stmt_close($stmt);

mysqli_close($link);
?>

Hi Simon, Yeah thats right. I had it working fine before using prepared statements. — James Duffield
– James Duffield, Commented Mar 5, 2018 at 9:43
The only reasons I can think of for it showing the PHP source, is a dodgy opening tag, or your webserver isn't set up properly. — Jonnix
– Jonnix, Commented Mar 5, 2018 at 9:44
You should remove this question as there does not seem to be a reproducible problem with the code. Or is there? Then you should post a real answer. — jeroen
– jeroen, Commented Mar 5, 2018 at 9:50

MRACHINI · Accepted Answer · 2018-03-05 09:48:48Z

0

using eval( $text ); will execute your string as PHP code. is that what you are looking for ?

PHP eval() function

Caution The eval() language construct is very dangerous because it allows execution of arbitrary PHP code. Its use thus is discouraged. If you have carefully verified that there is no other option than to use this construct, pay special attention not to pass any user provided data

answered Mar 5, 2018 at 9:48

MRACHINI

837 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

PHP Prepared statements from web form issues [duplicate]

1 Answer 1

Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Linked

Related