How to add data to mysql by url

Question

newbie at php here, basically I wish to know how to add data to my mysql table manually using the url.

For example, say I have a table called users which has 3 fields called 'ID', 'username' and 'password'. I wish to add data to the table like this:

http://localhost/register.php?id=1@username=bob@password=123@act=register (I'm not sure if this is entirely right) but yeah something like that.

Any help on how to do this would be much appreciated!

I'm not sure if that answers my question :S what exactly do you mean? I'm not trying to change the data, I'm trying to add data by using url, like the example I posted. — Wiz Franko
– Wiz Franko, Commented Apr 22, 2011 at 4:00
Yes, its not the answer, the answer(s) will be in the bottom area. Its just a recommendation to follow standard practices. GET is supposed to be idempotent, which means you can do the same operation over and over without any side effects. Imagine doing what you're doing 10x with the same data without impacting the state of your database. — lobster1234
– lobster1234, Commented Apr 22, 2011 at 4:03
Please research SQL Injection Attacks before you implement this solution. You will thank me for it later. — Wes
– Wes, Commented Apr 22, 2011 at 4:10
@wes Actually, if he does then he'll never thank you because he'll never get hacked and won't know that he would have otherwise. On the other hand, if he gets owned because doesn't follow your advice, he will wish he had later... :) — squawknull
– squawknull, Commented Apr 22, 2011 at 4:21

Andrew Truckle · Accepted Answer · 2021-02-21 14:03:13Z

7

mysql_connect('localhost', 'mysql_user', 'mysql_password');

mysql_select_db('database');

mysql_query("INSERT INTO table (id, username, password) VALUES ('".mysql_real_escape_string($_GET['id'])."', '".mysql_real_escape_string($_GET['username'])."', '".mysql_real_escape_string($_GET['password'])."')");

edited Feb 21, 2021 at 14:03

Andrew Truckle

19.5k17 gold badges93 silver badges232 bronze badges

answered Apr 22, 2011 at 3:59

bxfckrclooo

5981 gold badge4 silver badges8 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Mikecito · Accepted Answer · 2011-04-22 03:58:48Z

2

$query = "insert into users (username, password) values ('".$_GET['username']."','".$_GET['password']."'";

That would be to insert a user based on the act parameter.

Also, usually parameters on a get are split up by "&", not "@".

answered Apr 22, 2011 at 3:58

Mikecito

2,06311 silver badges17 bronze badges

1 Comment

GB_Bhayani ツ Over a year ago

when i insert data succesfully then how can i return thats filed id and print it??

Mujahid · Accepted Answer · 2011-04-22 06:19:35Z

2

First of all, if you're saving large data, better to use POST, rather than GET. But if you really need to send data to the server with URL, your URL should be change as below:

You should use '&' in place of '@'

http://localhost/register.php?id=1&username=bob&password=123&act=register

In Server side, you can retrieve the data by following:

$id = mysql_real_escape_string($_GET['id']);

$username = mysql_real_escape_string($_GET['username']); $password = mysql_real_escape_string($_GET['password']);

$sql = mysql_query('INSERT INTO table_name (id, username, password) VALUES ('.$id.', '.$username.', '.$password.'); if(!$sql){ echo "Error " . mysql_error(); }else{ echo "Success"; }

answered Apr 22, 2011 at 6:19

Mujahid

1,2375 gold badges32 silver badges64 bronze badges

Comments

Gowri · Accepted Answer · 2011-04-27 03:32:41Z

2

use

$id  = $_REQUEST['id'];
$username = $_REQUEST['username'];
$password = $_REQUEST['password'];
$act   = $_REQUEST['act'];

to get values from url

Then usual MySQL

Insert Query

refer

http://dev.mysql.com/doc/refman/5.5/en/insert.html

edited Apr 27, 2011 at 3:32

answered Apr 22, 2011 at 3:59

Gowri

16.9k27 gold badges103 silver badges162 bronze badges

4 Comments

Doug Molineux Over a year ago

+1 Yep $_REQUEST will pull either POST or GET, line 3 and 4 has an extra "=" that isn't needed tho :)

Gowri Over a year ago

Thanks for notification... typing mistake

zerkms Over a year ago

Why to retrieve from $_REQUEST if we know it will be exactly in $_POST?

Doug Molineux Over a year ago

Because if you ever change your input method, you won't have to change your $_POST or your $_GETs code, gives the code a bit of flexibility. Looks like the OP isn't using $_POST anyways he's using $_GET. Anyone who says GET is less secure than POST doesn't realize you can just as easily emulate a POST parameter as you can a GET (using many different methods). You should take the appropriate measures to sanitize the input no matter what input method is used.

Collectives™ on Stack Overflow

How to add data to mysql by url

4 Answers 4

Comments

1 Comment

Comments

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

1 Comment

Comments

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related