-1

I'm trying to insert a html form into a database trough php. but when I enter the form nothing happens. im working locally in a XAMPP enviroment.

Relevant HTML code:

<form action="bestellingCreate.php" method="POST">
      Tafelnummer<input name="tafel" type="text" class="form-control">
      Reserveringsnummer<input name="reserveringID" type="number" class="form-control">
      MenuItemID<input name="menuItemID" type="number" class="form-control">
      Aantal<input name="aantal" type="number" class="form-control">
      Prijs <input name="prijs" type="number" class="form-control">
      <br>
      <input type="submit">
      </form>

I've tested the db connection, so thats not the issue. my other CRUD functions work perfectly fine with the dbCon.php. I'm also not getting any error messages, also not when i disable the header function

PHP Code

<?php
include 'dbCon.php';

if(isset($_POST['submit'])){
  $tafel          = $_POST['tafel'];
  $reserveringID  = $_POST['reserveringID'];
  $menuItemID     = $_POST['menuItemID'];
  $aantal         = $_POST['aantal'];
  $prijs          = $_POST['prijs'];

  $sql="insert into `bestelling` (tafel,reserveringID,menuItemID,aantal,prijs) values ('$tafel','$reserveringID','$menuItemID','$aantal','$prijs')";

  $result=mysqli_query($con,$sql);
  if($result){
    echo "Bestelling toegevoegd";
  } else{
    die(mysqli_error($con));
    echo"Bestelling niet toegevoegd";
  } 
}
header("Location: bestellingRead.php");
exit;
?>

image of my db table that the Create function should insert the form data into

I would love some help with this. It is for my exam in the morning and i know there is probaly some ; that ive missed or something dumb like that.

  • 3
    You don't have any field named "submit". – gre_gor May 30 '22 at 23:22
  • I knew it was something stupid like that (; – Driek van der Meulen May 30 '22 at 23:27
  • **Warning:** You are wide open to [SQL Injections](https://php.net/manual/en/security.database.sql-injection.php) and should use parameterized **prepared statements** instead of manually building your queries. They are provided by [PDO](https://php.net/manual/pdo.prepared-statements.php) or by [MySQLi](https://php.net/manual/mysqli.quickstart.prepared-statements.php). Never trust any kind of input! Even when your queries are executed only by trusted users, [you are still in risk of corrupting your data](http://bobby-tables.com/). [Escaping is not enough!](https://stackoverflow.com/q/32391315) – Dharman May 31 '22 at 12:57

0 Answers0