PHP help again! Why won't this submit?

Butters · 24 Oct 2007 at 17:33

Hi guys, sorry for being a poo head.

Here is some code I've tried to generate myself

Code:

<?php 

if (!isset($_POST['submit']) || $_SERVER['REQUEST_METHOD'] != "POST")

$p_title = $_POST['title'];
$p_menu_title = $_POST['menutitle'];
$p_summary = $_POST['summary'];

$address = localhost;
$username = "mark1e_bourne";
$password = "******";
$database = "mark1e_bourne";

mysql_connect($address,$username,$password);
@mysql_select_db($database) or die( "Unable to select database");

$query = "INSERT INTO news VALUES ('$id','$p_title','$p_menu_title','$p_summary')";
mysql_query($query);

mysql_close();
?>

<html> 
<head> 
<title></title> 
</head> 
<body> 

<form action="" method="POST">

<p><label for="name">Title:</label><input type="text" id="title" name="title" /></p>

<p><label for="menutitle">Menu Title:</label><input type="text" id="menutitle" name="menutitle" /></p>

<p><label for="summary">Summary:</label><input type="text" id="summary" name="summary" /></p>


<p><input type="submit" class="button" name="submit" value="Submit Enquiry" /></p>
</form>
</body> 
</html>

Its meant to take the values from the HTML form and post them to my database.

However, when I click submit the page reloads blank and nothing gets entered into the database table 'news'.

Am I doing something wrong? (clearly)

Dano · 24 Oct 2007 at 17:36

Form action field is blank?

Butters · 24 Oct 2007 at 17:37

Its meant to be from what I understand if you want the page to run the php code at the top of it

Dano · 24 Oct 2007 at 17:39

Mmm, I've always used $_PHP_SELF in there...

robmiller · 24 Oct 2007 at 17:45

That first `if` is nonsensical, plus it only applies to the first line after it since you ommitted braces. Also, your script is pretty darn insecure.

PHP4:

Code:

<?php 

if ( $_SERVER['REQUEST_METHOD'] == 'POST' ) {
    $p_title = mysql_real_escape_string($_POST['title']);
    $p_menu_title = mysql_real_escape_string($_POST['menutitle']);
    $p_summary = mysql_real_escape_string($_POST['summary']);

    $address = localhost;
    $username = "mark1e_bourne";
    $password = "******";
    $database = "mark1e_bourne";

    mysql_connect($address, $username, $password);
    mysql_select_db($database);

    // Where are you getting "$id" from? You use it in your query
    // but don't define it, which is a security flaw if you have
    // register_globals turned on
    $id = null;
    
    mysql_query("INSERT INTO news VALUES('$id', '$p_title', '$p_menu_title', '$p_summary')");

    mysql_close();
}
?>

or PHP5:

Code:

<?php

if ( $_SERVER['REQUEST_METHOD'] == 'POST' ) {
    $db = new mysqli('localhost', 'mark1e_bourne', '*****', 'mark1e_bourne');

    $s = $db->prepare('INSERT INTO news (title, menu_title, summary) VALUES(?, ?, ?)');
    $s->bind_param('sss', $_POST['title'], $_POST['menutitle'], $_POST['summary']);

    $s->execute();
    $s->close();

    $db->close();
}
?>

(Check the fieldnames, I just guessed them.)

Dano said:
Form action field is blank?

A blank action implies that the form submits to itself.

Dano · 24 Oct 2007 at 17:47

robmiller said:
A blank action implies that the form submits to itself.

Learn something new everyday, lol.

Butters · 24 Oct 2007 at 17:59

Dano said:
Learn something new everyday, lol.

TEEHEE! I learnt that yesterday!

Rob, thanks

What makes it so insecure?

robmiller · 24 Oct 2007 at 18:03

http://php.robm.me.uk/#toc-SQLInjection

Butters · 24 Oct 2007 at 18:07

Cool, thanks

Umm, I seem to be getting this now:-

Code:

Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: Access denied for user 'nobody'@'localhost' (using password: NO) in /home/mark1e/public_html/login/test.php on line 4

Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: A link to the server could not be established in /home/mark1e/public_html/login/test.php on line 4

Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: Access denied for user 'nobody'@'localhost' (using password: NO) in /home/mark1e/public_html/login/test.php on line 5

Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: A link to the server could not be established in /home/mark1e/public_html/login/test.php on line 5

Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: Access denied for user 'nobody'@'localhost' (using password: NO) in /home/mark1e/public_html/login/test.php on line 6

Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: A link to the server could not be established in /home/mark1e/public_html/login/test.php on line 6