information doesn' show in database. XAMPP

Question

I am trying to make a simple RSVP program where I the user just type in their first and last name and then clicks yes or no. The information is then taken to the database. I am stuck where the user can type in the first and last name and click yes or no but it does not show up in the database. Here is what I have so far. Any help will be appreciated thanks. I am still a noob at php. I am also using xampp for my database. Thanks

This is the first half

<H1><div align="center">RSVP</div></H1>

<H3>Enter in the information that is requried</H3>

<form method ="POST" action = "RSVP.php">

Please type in your first name</br>

<input type = "text" name="fname"/></br>

Please type in your last name</br>

<input type = "text" name="lname"/>

</br></br></br></br>

<H2>Will you be attending?</h2>

<input type="radio" name="yorn" value="Yes">Yes

<input type="radio" name="yorn" value="No">No</br>


<input type="submit" value="Submit">

</form>

This is the php half

<?php

if(empty($_POST['fname']) || empty($_POST['lname']))

print "Please type in BOTH first name and last name";
else{

$DBConnect = @mysql_connect("localhost", "Jordan", "bigboy");

if ($DBConnect === FALSE){

    print "<p>Unable to connect to the database server.<p>". "<p>Error code " 
                .mysql_errno(). ": ". mysql_error() . "</p>";

}else{

    $DBName = "jdatabase";

    mysql_select_db("jdatabase") or die(mysql_error());

    $TableName = "RSVP";

    $firstname = $_POST['fname'];

    $lastname = $_POST['lname'];

    $YorN = $_POST['yorn'];

    $SQLsting = "INSERT INTO '$TableName' VALUES(NULL, 

                   '$firstname','$lastname','$YorN')";

$QueryResult = @mysql_connect($SQLsting, $DBConnect);

}if ($QueryResult === FALSE){

    print "<p>Unable to execute query.<p>". "<p>Error code " 
                .mysql_errno($DBConnect). ": ". mysql_error($DBConnect) . "</p>";

}else{

    print "Thank You for RSVP";

}

mysql_close($DBConnect);    

}   

?>

You are using [an **obsolete** database API](http://stackoverflow.com/q/12859942/19068) and should use a [modern replacement](http://php.net/manual/en/mysqlinfo.api.choosing.php). You are also **vulnerable to [SQL injection attacks](http://bobby-tables.com/)** that a modern API would make it easier to [defend](http://stackoverflow.com/questions/60174/best-way-to-prevent-sql-injection-in-php) yourself from. — Quentin, Dec 18 '12 at 17:53

score 1 · Answer 1 · answered Dec 18 '12 at 18:05

Here is basic mysqli usage with escape of input.

$DBName = "jdatabase";
$TableName = "RSVP";
$firstname = $_POST['fname'];
$lastname = $_POST['lname'];
$YorN = $_POST['yorn'];

/* Connection info for PHP/MySQL test database. */
defined('DB_HOST') ? NULL : define('DB_HOST', 'localhost');
defined('DB_USER') ? NULL : define('DB_USER', 'testUzer');
defined('DB_PWD') ? NULL : define('DB_PWD', 'xYzT@9123');
defined('DB_NAME') ? NULL : define('DB_NAME', $DBName);

/* Connect to database */
$mysqli = new mysqli(DB_HOST, DB_USER, DB_PWD, DB_NAME);
if ($mysqli->connect_errno) exit("ERROR: Could not connect to database.");

/* Build the query string and escape input. */
$query = sprintf("INSERT INTO $TableName (first_name, last_name, yorn) VALUES('%s', '%s', '%s')", 
$mysqli->real_escape_string($firstname), 
$mysqli->real_escape_string($lastname), 
$mysqli->real_escape_string($YorN));

/* Insert the record. */
$result = $mysqli->query($query);
if(! $result) exit("ERROR: Database query failed.");

And if you must use the php mysql driver and not the mysqli driver, you can fix your code by removing the single quotes around $TableName in the INSERT statement. Escape your input with mysql_real_escape_string(). And finally, use mysql_query in place of @mysql_connect in your assignment to $QueryResult. — A Jolly Geek, Dec 18 '12 at 18:17

score 0 · Answer 2 · answered Dec 18 '12 at 18:13

Even if you are going to use the old mysql_* way, you're not querying the database... you should call on mysql_query... in your code you are using the mysql_connect twice. You won't receive an error from this because of the @ symbol in front of it.

$QueryResult = mysql_query($SQLsting, $DBConnect);

information doesn' show in database. XAMPP

2 Answers2