php - Cannot insert new values in the database -
i'm new programming , i'm trying work on something. code i've used html php. when run on server , put values, refreshes page. there need change on code
for connecting:
<?php $servername = "localhost"; $username = "root"; $password = "1234"; $database = "finance_payments"; //connection error $conn_error = "could not connect."; // create connection $conn = mysql_connect($servername, $username, $password); $db_select = mysql_select_db($database); // check connection , database selection if(!mysql_connect($servername, $username, $password) || !mysql_select_db($database)){ die($conn_error); } ?> and page:
<!doctype html> <html lang="en"> <head> <meta charset="utf-8"> <title>payments register</title> <link rel="stylesheet" type="text/css" href="styles/registration_stylesheet.css"> </head> <body> <?php //include/require database connection file require 'includes/dbconnect.php'; //checking if fields set if(isset($_post['s_no']) && isset($_post['date']) && isset($_post['payee']) && isset($_post['details']) && isset($_post['branch_or_dept']) && isset($_post['amount']) && isset($_post['invoice_no'])){ //creating variables $s_no = $_post['s_no']; $date = $_post['date']; $payee = $_post['payee']; $details = $_post['details']; $branch_or_dept = $_post['branch_or_dept']; $amount = $_post['amount']; $inovice_no = $_post['invoice_no']; //checking if variables not empty if(!empty($s_no) && !empty($date) && !empty($payee) && !empty($details) && !empty($branch_or_dept) && !empty($amount) && !empty($inovice_no)){ //if not empty //insert database //to escape html injection - mysql_real_escape_string $query = "insert payments_miscellaneous (s_no, date, payee, details, branch_or_dept, amount, invoice_no) values ('".mysql_real_escape_string($s_no)."', '".mysql_real_escape_string($date)."', '".mysql_real_escape_string($payee)."','".mysql_real_escape_string($details)."','".mysql_real_escape_string($branch_or_dept)."','".mysql_real_escape_strin g($amount)."','".mysql_real_escape_string($inovice_no)."')"; if($query_run = mysql_query($query)){ //direct success page header('location: finance_records/register_success.php'); }else//if query fails{ echo "record not inserted, please try again later."; } }else{//if empty echo "all fields required."; } ?> <header class="body"> <h2><i><u>payments registration form</u></i></h2> </header> <section class = "body"> <form method="post" action="miscellaneous.php"> <label>s.no</label> <input name = "s_no" placeholder = "enter number"> <label>date</label> <input name = "date" placeholder = "enter date"> <label>payee</label> <input name = "payee" placeholder = "enter name of payee"> <label>details</label> <input name = "details" placeholder = "enter details of payment"> <label>branch/dept</label> <input name = "branch_or_dept" placeholder = "enter branch/dept of payee"> <label>amount</label> <input name = "amount" placeholder = "enter amount in zmw or usd"> <label>invoice no</label> <input name = "inovice_no" placeholder = "enter invoice number"> <input id="submit" name="submit" type="submit" value="enter"> </form> <p> <a href="index.php">go homepage</a> </p>
dateis keyword in mysql. have escape column name:
$query = "insert payments_miscellaneous (s_no, `date`, payee, details, branch_or_dept, amount, invoice_no) values ('".mysql_real_escape_string($s_no)."', '".mysql_real_escape_string($date)."', '".mysql_real_escape_string($payee)."','".mysql_real_escape_string($details)."','".mysql_real_escape_string($branch_or_dept)."','".mysql_real_escape_strin g($amount)."','".mysql_real_escape_string($inovice_no)."')"; hint 1: stop using deprecated mysql_*api. use mysqli_´orpdo` instead prepared statements prevent sql-injection.
hint 2: check errors after run sql-command.
Comments
Post a Comment