PDA

View Full Version : php and mysql form problem


ggcb
6-15-05, 04:28 PM
I am new to php and am using a simple contact form to send info to mysql. The form action is HandleForm.php. It sends a record to the mysql database, but the data is all empty when I test it. I've tested the form by using mailto: and my email address in the action, and the record arrives filled with data. So, I think it's my php script. I copied the script from the Quick Visual Guide: PHP For The World Wide Web and added my own fields. Is there a setting on the mysql database I need to make? permissions or something? Here is my php script.

<html>
<head>
<title>Inserting Data into a Database</title>
<body>
<?php
/*This page receives and handles the data generated by "newsletterform.html".*/
//Trim the incoming data.
$Array["FirstName"] = trim ($Array["FirstName"]);
$Array["LastName"] = trim ($Array["LastName"]);
$Array["Email"] = trim ($Array["Email"]);
$Array["Position"] = trim ($Array["Position"]);
$Array["Organization"] = trim ($Array["Organization"]);
$Array["City"] = trim ($Array["City"]);
$Array["State"] = trim ($Array["State"]);
$Array["Phone"] = trim ($Array["Phone"]);
$Array["Comments"] = trim ($Array["Comments"]);

//Set the variables for the database access:
$Host = "mysql11.powweb.com";
$User = "user";
$Password = "pwd";
$DBName = "database";
$TableName = "table";

$Link = mysql_connect($Host, $User, $Password);
$Query = "INSERT into $TableName values ('0', '$Array[FirstName]','$Array[Lastname]','$Array[Email]','$Array[Position]','$Array[Organization]',
'$Array[City]','$Array[State]','$Array[Phone]','$Array[Comments]')";
print("The Query is:<BR>$Query<P>\n");
if(mysql_db_query($DBName, $Query, $Link)){
print("The query was successfully executed!<BR>\n");
}else{
print("The query could not be executed!<BR>\n");
}
mysql_close($Link);
?>
</body>
</html>

RTH10260
6-15-05, 07:28 PM
First: always edit out your database sign-on information, this is a very public place, including indexing on search machines !!!!!

RTH10260
6-15-05, 07:33 PM
Second, you need a bit more background on Forms and how the information gets back into your script.

When the form specifies METHOD=GET, then your script accesses the variables using the superglobal variable array by name $_GET, when the form specifies METHOD=POST, use $_POST.

Warning: you should always sanitize all your form input before storing in a database.
Ref: PHP Security Consortium http://phpsec.org/projects/guide/

ggcb
6-16-05, 05:30 AM
Thanks. I did sanitize it when I posted on the php forum, but apparently forgot here. Geesh What a doofus I am. Anyway, I did finally get it.