PHP doesn't send data to MySQL -


have problem couldn't find solution for, though searched through many sources (and questions here too). so, here is.
php-code below suppose collect data html-form , send local wamp-server. but, though final check shows me "success!", no new rows in database's table found, stays empty. names correct, commands (as see it) too, don't know what's wrong.
hope guys me. ^^

//check if user submited form if (isset($_post['submit'])) {     //check if filled     if (empty($_post['itemname']) || empty($_post['itempic']) || empty($_post['itemprice']) || empty($_post['itemprovider'])) {         echo '<script>alert ("fill out form please!")</script>';     } else {         $conn = new mysqli('localhost:3306', 'root', '', 'goods-review');         //check if connection established         if (mysqli_connect_errno()) {             exit('connect failed: ' . mysqli_connect_error());         }         //sending data         $newitem = array('itemname' => $_post['itemname'], 'itempic' => $_post['itempic'], 'itemprice' => $_post['itemprice'], 'itemprovider' => $_post['itemprovider']);         $sql = "insert goods (itemname, itempic, itemprice, itemdate, itemprovider) values ('" . $newitem['itemname'] . "', '" . $newitem['itempic'] . "', '" . $newitem['itemprice'] . "', date('y:m:d, h:i:s'), '" . $newitem['itemprovider'] . "')";         //check if sent         if ($sql) {             echo '<script>alert ("success!")</script>';         } else {             echo '<script>alert ("error!")</script>';         }         $conn->close();     } } 

the code assigning string value variable.

  $sql = "insert ..."; 

and string value not submitted database; it's not being executed sql statement. there's nothing magical name of variable. far php concerned, code assigning value variable. that's it.

if want execute sql statement, need add code that. shouldn't difficult find example of how that.

important note: code in question appears create sql statement vulnerable sql injection. better pattern use prepared statements bind placeholders.

reference: mysqli_prepare

if there's (unfathomable) reason can't use prepared statements, @ minimum, potentially unsafe values included in sql text must escaped.

reference: mysqli_escape_string


Comments

Popular posts from this blog

java - Jasper subreport showing only one entry from the JSON data source when embedded in the Title band -

mapreduce - Resource manager does not transit to active state from standby -

serialization - Convert Any type in scala to Array[Byte] and back -