My insert data sql command in my PHP code is not working. Can anyone help please?
I have a registration form that takes the values from the input fields (name, lastname, email, username and password)
The values that the user inputs in this fields should be saved into my table "users" whith columns (ID [which is the primary key /INT], name [TEXT], lastname[TEXT], e-mail [VARCHAR], username[VARCHAR] and password [VARCHAR]) .
Here is my current code:
if (isset ($_POST['name'],$_POST['lastname'],$_POST['email'],$_POST['username'], $_POST['password']))
{
//connect to database
$conn = mysqli_connect ('localhost', 'root', '', 'test_database');
if ($conn)
{
$sql="SELECT username FROM users WHERE username = '" . $_POST['username'] . "';";
$query = mysqli_query ($conn, $sql);
$result = mysqli_fetch_array ($query);
if ($result ['username'])
{
header ('Location: ' . $_SERVER['PHP_SELF'] . '?errno=1');
}
else
{
$sql="INSERT INTO users (ID, name, lastname, e-mail, username, password) VALUES (' ','" .$_POST['name'] . "' ,'" . $_POST['lastname']. "' ,'" . $_POST['email']. "' ,'" . $_POST['username']. "' ,'" . $_POST['password']. "');";
mysqli_query ($conn, $sql);
mysqli_close ($conn);
//registration completed, redirect to index page
//header ('Location:index.php?reg=1');
}
}
else
{
echo 'connection error';
}
}
mysqli_error
give you anything? Also, your code is very exposed to SQL-injection: you should start using prepared statements with placeholders to avoid this exposure. – Qirel Mar 16 at 10:54VALUES (' ',
– Saty Mar 16 at 10:54INSERT .... (name, ....) VALUES('JOHN', ....
Like so. – Epodax Mar 16 at 10:58