HTML form insert into MYSQL

html, mysql, php

Solution

If you're new to PHP/MySQL you really shouldn't be starting out using procedural style as it's clunk and really not recommended. If you get to grips with OOP (Object Orientated Programming) now it will save you trouble in the long run!

Example:

mysqli_connect($host, $user, $password, $database) or die("Error " . mysqli_error($link));

Should become

 $conn = new mysqli($host, $user, $password, $database);
// check connection
if ($conn->connect_error) {
  trigger_error('Database connection failed: '  . $conn->connect_error, E_USER_ERROR);
}

and

    $firstname1 = mysqli_real_escape_string($firstname);

to

    $firstname1 = $conn->real_escape_string($firstname);

When you come to writing advanced PHP (ie. classes etc.) using OOP will already be in that noodle!

Anyway, the issue you have:

1. You're missing the closing > from your first form element

<p>First Name: <br><input type="text" name="user_firstname" size="25 maxlength="25"/></p>

2. You have also requested the post data "user_type" which you have not set as a form element

3 you have added 1 to the variables, this isn't necessary (and also you didn't add the 1's to your query, ideally you should rename them so they are logical)

$firstname1 = mysqli_real_escape_string($firstname);
$lastname1  = mysqli_real_escape_string($lastname);
$email1 = mysqli_real_escape_string($email);
$password1 = mysqli_real_escape_string($password);

Should changed to

$firstname_escaped = mysqli_real_escape_string($firstname);
$lastname_escaped  = mysqli_real_escape_string($lastname);
$email_escaped = mysqli_real_escape_string($email);
$password_escaped = mysqli_real_escape_string($password);

4 You don't need to INSERT columns that (should be set up as auto increment) as it will do it automatically

$query = mysqli_query($link, "INSERT INTO users (user_id, user_firstname, user_lastname, user_email, user_password) VALUES ('', '$firstname', '$lastname', '$email', '$password')");

Should be

$query = mysqli_query($link, "INSERT INTO users (user_firstname, user_lastname, user_email, user_password) VALUES ('$firstname', '$lastname', '$email', '$password')");

5 !!!!You are not encrypting the password being inputted into the database!!!!! At the very LEAST you should slap that sucker with

 $password = md5($_POST['user_password']); //added md5 encryption

Although it is highly recommended to use the PHPass library as it uses PHP's crypt() functionality without having to work out all the headaches!

Problem

Okay, this is probably super easy for all you PHP/MYSQL experts, but I'm just learning and I've hit a roadblock. I made a register form form in HTML and I want to insert the users input information in the MSQL database with PHP. Here's my form: ``` <form action="" method="post"> <p>First Name: <br><input type="text" name="user_firstname" size="25 maxlength="25"/</p> <p>Last Name: <br><input type="text" name="user_lastname" size="25" maxlength="25" /></p> <p>Email Address: <br><input type="email" id="email" name="user_email" size="25" maxlength="40"/><p> <p>Create a Password: <br><input type="password" name="user_password" size="25" maxlength="40"/></p> <p><br><input type="submit" value="register"/></p> </form> ``` and here's my php code: ``` $host = "localhost"; $user = "root"; $password = ""; $database = "listings_db"; $tbl_name = "users" $link = mysqli_connect($host, $user, $password, $database) or die("Error " . mysqli_error($link)); if (isset($_POST['user_firstname'], $_POST['user_lastname'], $_POST['user_email'], $_POST['user_password'], $_POST['user_type'])) { $firstname = $_POST['user_firstname']; $lastname = $_POST['user_lastname']; $email = $_POST['user_email']; $password = $_POST['user_password']; $type = $_POST['user_type']; $errors = array(); if(empty($firstname) || empty($lastname) || empty($email) || empty($email) || empty($password) || empty($type)) {$errors [] = '*All fields are required!';} else { if(filter_var($email, FILTER_VALIDATE_EMAIL) === false) {$errors[] = '*The email address you entered is not valid!' ;} if(strlen($firstname) > 25) {$errors[] = '*The email address you entered contains too many characters!';} if(strlen($lastname) > 25) {$errors[] = '*The first name you entered contains too many characters!';} if(strlen($email) > 40) {$errors[] = '*The last name you entered contains too many characters!';} if(strlen($password) > 40) {$errors[] = '*The password you entered contains too many characters!';} if(strlen($type) != true){$errors[] = '*Please select an account type!';} } $firstname1 = mysqli_real_escape_string($firstname); $lastname1 = mysqli_real_escape_string($lastname); $email1 = mysqli_real_escape_string($email); $password1 = mysqli_real_escape_string($password); $query = mysqli_query($link, "INSERT INTO users (user_id, user_firstname, user_lastname, user_email, user_password) VALUES ('', '$firstname', '$lastname', '$email', '$password')"); } ``` What's wrong with my code? Thanks in advance for your help!

Original source