0

I'm trying for last hour solve this problem. I have a long form and I'm trying to upload info into mysql database. Into table I made. This is the mysql query I'm using:

mysql_query("INSERT INTO `users_temp`(`first_name`, `surname`, `birthday`, `nationality`, `email`, `mobile`, `landline`, `address`, `town`, `post_code`, `country`, `password`, `code_conf`) VALUES ([$f_name],[$s_name],[$bday],[$nationality],[$email],[$mobile],[$landline],[$address],[$town],[$post_code],[$country],[$pass],[$conf_code])");

If anyone see any problem why it doesn't work pls let me know. Thank you...

$f_name         = $_POST["f_name"];
$s_name         = $_POST["s_name"];
$pass           = $_POST["pass"];
$birthday       = $_POST["bday"];
$nationality    = $_POST["nationality"];
$email          = $_POST["email"];
$mobile         = $_POST["mobile"];
$landline       = $_POST["landline"];
$address        = $_POST["address"];
$town           = $_POST["town"];
$post_code      = $_POST["post_code"];
$country        = $_POST["country"];

$conf_code      = substr(md5(uniqid(rand(), true)), 1, 70);

include("connect_into_mysql.php");
mysql_select_db("jzperson_edu", $conn);

$res_01 = mysql_query("SELECT * FROM users WHERE email='$email'");
$count_01 = mysql_num_rows($res_01);

if($count_01==0)
{
mysql_query("INSERT INTO users_temp ('first_name','surname','birthday','nationality','email','mobile','landline','address','town','post_code','country','password','code_conf') VALUES ('$f_name','$s_name','$bday','$nationality','$email','$mobile','$landline','$address','$town','$post_code','$country','$pass','$conf_code')");
header("Location: home.php");
}else{echo "This email is already registered. If you lost your password you can reset it here.";}
3
  • Do you get any errors? Are you sanitizing those variables you put in the database? ps, you can use {$varname} or '.$varname.', not [$varname]` Sep 8, 2012 at 21:46
  • I'll put whole code into question. I'm editing it now.
    – Jakub Zak
    Sep 8, 2012 at 21:49
  • What is the exact error message? And please remove the square brackets [ ] and try it again. What error message do you have now? Sep 8, 2012 at 21:49

1 Answer 1

1

1/ You must be aware of SQL injections : please read this article. Encapsulate all your $_POST data with mysql_real_escape_string, for example :

$f_name         = mysql_real_escape_string($_POST["f_name"]);

2/ MySQL will be deprecated soon, see the red box here.

3/ After all your headers, put a die() (else, execution of your code continues until the end and if client's brwoser redirection is disabled, he may see some unauthorized content).

4/ Do not write very long request in a single line, this may avoid troubles and make the job easier. And to debug it, add a "or die(mysql_error()) at the end" which will display a message helping you alot to get the solution.

mysql_query("
INSERT INTO users_temp (
    'first_name','surname','birthday',
    'nationality','email','mobile',
    'landline','address','town',
    'post_code','country','password',
    'code_conf'
) VALUES (
    '$f_name','$s_name','$bday',
    '$nationality','$email','$mobile',
    '$landline','$address','$town',
    '$post_code','$country','$pass',
    '$conf_code'
)
") or die(mysql_error());

By the way, you are making a check in the user table and you insert into the user_tmp table. You may have conflicts trouble in such a way, nope?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.