php - Why is data not inserted in this code into my database? I suspect a SQL Error -
updated question
previous question: why data not inserted in code database?
current error recieved:
insert command denied user ''@'localhost' table 'all'
here php/html code,
<?php /* assignment form rohan verma, alias rhnvrm. */ // initialisation include('config.php'); // end initialisation ?> <!doctype html> <html> <head> <!-- ... --> <title>assignment</title> </head> <body> <form action="submit.php" method="post"> <label>roll no:</label> <select name="roll"> <optgroup label="choose roll number"> <?php // generator options ($i = 1; $i <= 20; $i++) { echo "<option value = '$i'>$i</option>"; } //end ?> </optgroup> </select> <label>your name: </label> <input type="text" name="u_name"/> <br /> <label>name of person: </label> <input type="text" name="p_name"/> <br /> <label>about him:</label> <br /> <textarea style="width:350px;" name="p_text"></textarea> <br /> <input type="submit" /> </form> </body> </html> here submission code.
<?php /* submission rhnvrm +for project assignment */ $roll_no = $_post['roll']; $u_name = $_post['u_name']; $p_name = $_post['p_name']; $p_text = $_post['p_text']; $sql = "insert `sv_assign`.`all` (`roll`, `name`, `person`, `about`) values (".(int)$roll_no .", " . mysql_real_escape_string($u_name) . ", " . mysql_real_escape_string($p_name) . ", ". mysql_real_escape_string($p_text) . ");"; mysql_query($sql) or die(mysql_error()); mysql_close() or die ?> config.php
<?php $dbhost = 'localhost'; $dbuser = 'root'; $dbpass = '*********'; $conn = mysql_connect($dbhost, $dbuser, $dbpass) or die('error connecting mysql'); $dbname = 'sv_assign'; mysql_select_db($dbname); ?>
this \'$roll_no\' should '$roll_no'. same rest. what's happening it's becoming sample below. you're using double quotes wrap query string no need escape single quotes inside.
values (\'value\', \'value\', \'value\', \'value\');
**edit**
sanitize code avoid sql injections using mysql_real_escape_string or use pdo handling queries better. refer @daok mysql_real_escape_string reminder.
note: answer prior op updating question error in query.
Comments
Post a Comment