-2

I am doing a project in HTML, CSS, JAVASCRIPT, PHP and MariaDB, doing a form in which is going to be shown the data from the database in another .php page. I am getting this error and I don't know how to solve it

<?php
    $name = $_POST['name'];
        $crust = $_POST['crust'];
        $topping = $_POST['topping'];
    if(isset($name) && isset($crust) && isset($topping){
    $query = "INSERT INTO `order`(`name`, `crust`, `topping`) VALUES ('$name','$crust', '$topping')";
    }
    ?>
  • 2
    You're missing the closing `)` around the conditions in your `if (....)` statement. This: `&& isset($topping){` should be `&& isset($topping)){`. If you use a decent IDE, it should be able to tell you if your code contains syntax errors while you write your code. – M. Eriksson May 28 '22 at 11:08
  • 1
    **Warning!** You're open to [SQL injection attacks](https://owasp.org/www-community/attacks/SQL_Injection)! Read [how to prevent SQL injection in PHP](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) by using prepared statements with bound parameters instead of injecting variables directly into your queries. It's not just about security. If your data contains, for example, a single quote `'`, your query will break. – M. Eriksson May 28 '22 at 11:10
  • Thank you for your advice. Unfortunately, I don't use a decent IDE for this project and I don't think that I have enough time for this :( – Valentina Pipirigeanu May 28 '22 at 11:18
  • 3
    Don't have enough time for what? Downloading/installing a proper IDE (like VSCode or similar) or to write secure and proper code? You will save a lot of time using a proper IDE so that will be a time saver in the end (installing an IDE would probably have been faster than posting this question and waiting for replies). And writing secure code should always be the highest prio. – M. Eriksson May 28 '22 at 11:20

0 Answers0