insert into database

raninda · Joined: 10 Apr 2008 Posts: 11

hi, i have a code like this

kanenas · Joined: 14 Dec 2004 Posts: 191

Please provide minimal test cases rather than posting all of the code you're having problems with. Including extraneous material and leaving out potentially necessary source (e.g. 'db.php') makes it much harder to answer questions. Cutting out most of the 'option' elements in your example still gives enough to see potential problems. Moreover, this is a good debugging technique; if you cut out a portion of the source and you still see the same issue, then what you cut isn't involved in the problem.

If you check your error log, you'll probably see something like: "Undefined index: Submit in [...]". This message should draw your eye to the '$Submit = $_POST["Submit"]' line in your script. When debugging, always check your logs first; they will help you figure out what's going wrong.

Is mysql_connect() called in db.php? If not, the mysql_* functions may fail.

The $_REQUEST array is also often a better choice than $_POST because it combines form variables submitted either by POST or GET.

There are 2 errors, 1 warning-causing approach with your submission detection code and 1 HUGE security hole that jump out. The first error is that the name for the 'submit' form variable in "$_POST['Submit']" is capitalised while it's all lower case in the corresponding HTML element ('<input type="submit" value="submit">'). The second error is the submit button isn't given a name, so browsers aren't sending a value for it. Either test for one of the other form variables or name the submit button.

The line "$Submit = $_POST['Submit'];" causes a warning to be logged because "$_POST['Submit']" isn't defined. Better to run the isset test (or array_key_exists()) on $POST[...] or $_REQUEST[...], which won't cause a warning because 'isset' is a special form. Something like "if (isset($_REQUEST['dd'])) { ...".

The garing security hole is that you pass the form values to the SQL statement with only the most basic processing. Remember that there's no guarantee an HTTP request is being sent unadulterated from the form on the page you create. A user can alter the form to their heart's content or just construct their own request. Read about SQL injection in the PHP documentation for more information.

Play around with the following (untested)