0
<?php

$username = $_POST['username'];
$password = $_POST['password'];

if($username&&$password)
{

$connect = mysql_connect("CiniCraftData.db.55555555.hostedresource.com", "CiniCraftData", "*********") or die("Couldn't Connect");
mysql_select_db("CiniCraftData") or die ("Couldn't Find Database"); 

            $query = "INSERT INTO CiniUsers ('username.CINIDAT') VALUES('$username')";
            $result = mysql_query($query) or die("Error occurred.");

}
else die("Please enter a username and password.");

?>

For this part of the code:

$query = "INSERT INTO CiniUsers ('username.CINIDAT') VALUES('$username')";

The VALUES seem to not be working properly, I need whatever the string value of $username is to be inserted into my CiniUsers database. What do I need to do to make the code above work? I'm very new to php and sql syntax and the guides I'm finding online are all completely different from each other as if they keep updating php.

5
  • 4
    WARNING! Your code contains an SQL injection vulnerability. Please switch to PDO or mysqli so you can use prepared statements with parameterized queries.
    – Charles
    Dec 10, 2012 at 1:35
  • If you are using mysql, there is a great section in phpMyAdmin that you can test your SQL of queries in to see if they return the results you are looking for. It saves you having to worry about the headaches that can be attached through php. Once you know that you have the right query for sure, you can then return to focusing on your php. It is a great strategy when you get to more complex SQL statements
    – Matt
    Dec 10, 2012 at 1:51
  • My sql php queries work fine if I just tell them to insert a fixed value, It's just useless to me unless I can get the query to insert a string variable instead of just text so whatever a user puts in the text box that information can go straight to the database. I was going to worry about things like "That Username Has Been Taken" errors as soon as I can get the user to add data in the first place. Dec 10, 2012 at 2:16
  • Instead of printing Some kind of error occurred, why not print the SQL error message so you'll know WHY it failed? See the mysql_error() function.
    – Barmar
    Dec 10, 2012 at 2:32
  • There are examples of how to use parametrized queries at bobby-tables.com/php.html . Learn to use them now while you are a novice so you don't have to break bad habits later. Dec 10, 2012 at 3:11

4 Answers 4

1

Try reviewing this part:

$query = "INSERT INTO CiniUsers ('username.CINIDAT') VALUES('$username')";

The syntax is:

$query = "INSERT INTO table (column) VALUES ('$strvar')";

What is the column name you wanted to insert into?
If it is username.CINIDAT then try removing the qoutes.

Like this:

$query = "INSERT INTO CiniUsers (username.CINIDAT) VALUES ('$username')";

or maybe your column is named username so:

$query = "INSERT INTO CiniUsers (username) VALUES ('$username')";

UPDATE
The query from your comment, change it to this:

$query = "INSERT INTO CiniUsers (username.CINIDAT) VALUES ('$username')";
3
  • Yeah, my column name is username.CINIDAT. If I just try: $query = "INSERT INTO CiniUsers (username.CINIDAT) VALUES ('username')"; instead then the string value of "username" is added to the database. But I really need it to be a string specified by a user. Dec 10, 2012 at 1:41
  • check updated answer. The reason for that is username is a string, not a variable. $username is the variable and you are not using that in your query.
    – madziikoy
    Dec 10, 2012 at 1:43
  • You just need to pass a PHP variable into the SQL statement. The value of the variable must be set by the user BEFORE the SQL statement is assigned to your $query variable or the variable with be evaluated to an empty string. It looks like this should work via you $username = $_POST['username']; try echoing the $username to make sure that a value is being assigned properly from the previous page.
    – Matt
    Dec 10, 2012 at 2:51
1

The format for the SQL statement is as so:

INSERT INTO nameOfTable (column1, column2, column3, etc) VALUES ('column1', 'column2', 'column3', 'etc')

You MUST make sure that you are using the field names exactly as they are stored in MySQL. Your SQL could appear like so:

$query = "INSERT INTO CiniUsers (username) VALUES('$username')";

OR

$query = "INSERT INTO CiniUsers (username) VALUES('{$username}')";

Another thing that may help is that your die() statement is not very helpful. Yes, it is a bummer when your php program quits early, but it will save you a lot of time and frustration if you know why it quit. Although you may still be learning PHP and MySQL and may not know what the errors mean, they will start to make sense the more you see them and can tell you whether your query was bad, the connection failed or many more things. Change to something like this:

$connect = mysql_connect("CiniCraftData.db.55555555.hostedresource.com", "CiniCraftData", "*********") or die("Couldn't Connect: mysql_error()");
mysql_select_db("CiniCraftData") or die ("Couldn't Find Database: mysql_error()");
...
$result = mysql_query($query) or die("Some kind of error occurred...Query failed: mysql_error()");

You find that seeing the mysql_error() will help you solve problems like this much faster.

USE phpMyAdmin to test your query out, your query may be working perfectly. It is really the only way to know for sure. Use the suggested SQL and replace the PHP variable with some dummy data like "testUsername_1". If the query works, you will have manually added the username to the db, if not, the problem lies in SQL statement.

Here is some documentation on SQL INSERT INTO statements if you need more details: http://www.w3schools.com/sql/sql_insert.asp

0

I think you should use mysqli or pdo. This liberary you are using is deprecated.

That said, what is username.CINIDAT? I think this is where your problem is. It should be something like this

$query = "INSERT INTO CiniUsers (username) VALUES('$username')";

I am assuming that CiniUsers is the table name and username is the column name.

-1

The simplest way is to build the query by concatenating the statement with the value.

$query = "INSERT INTO CiniUsers ('username.CINIDAT') VALUES('".$username."')";

Without validation, this is not a very good idea, or something like this is very easy.

2
  • Why is this any better than the original? You don't need concatenation when the string is in double quotes, since variables are interpolated.
    – Barmar
    Dec 10, 2012 at 2:33
  • Wasn't aware of this, its been a while since I PHP'd. Thanks!
    – flacnut
    Dec 10, 2012 at 2:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.