0

I am trying to create a Python script that will fill some information in the database. For the server side I have used PHP and when I try to submit information using a browser, it works. But when I try to do it using the below Python script, it doesn't.

import requests

url_insert = 'http://192.168.1.100/data.php'

data_insert = {'fullname':'spiderman',
    'ssn':'1234',
    'dept':'Security',
    'salary':10000,
    'homeaddress':'New York',
    'btn_save':'Save'}

req = requests.post(url_insert, data = data_insert)
print(req.text)

I get the following error:

INSERT INTO emp_record (ename, ssn, dept, salary, homeaddress) VALUES ('', '', '', , '')<br>You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ' '')'

The code for data.php is:

<?php
require("database.php");

if (isset($_POST["btn_save"])) {
    $fullname = $_POST["fullname"];
    $ssn = $_POST["ssn"];
    $dept = $_POST["dept"];
    $salary = $_POST["salary"];
    $homeaddress = $_POST["homeaddress"];

    echo $fullname . "<br>";
    echo $ssn . "<br>";
    echo $dept . "<br>";
    echo $salary . "<br>";
    echo $homeaddress . "<br>";
}

$sql = "INSERT INTO emp_record (ename, ssn, dept, salary, homeaddress)
        VALUES ('$fullname', '$ssn', '$dept', $salary, '$homeaddress')";

$result = mysqli_query($conn, $sql);

if ($result) {
    echo "New record created successfully";
} else {
    echo "Error: " . $sql . "<br>" . mysqli_error($conn);
}

?>

This shows the contents of the database connection file:

<?php
$servername = "localhost";
$username = "root";
$password = "";
$database = "employees";

$conn = new mysqli($servername, $username, $password, $database);

if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
} else {
    echo "Connected Successfully." . "<br>";
}

And the following is the contents of the index.php file which contains the HTML form:

<html>
<head>
<title>RETRIEVE DATA</title>
</head>
<body>
<form action="data.php" method="POST">

    <div class="form-group">
        <label for="id">Full Name</label>
        <input type="text" name="fullname" id="fullname" value="" placeholder="FullName">
        <br>
        <br>
        <label for="id">Social Security Number</label>
        <input type="text" name="ssn" id="ssn" value="" placeholder="Social Security Number">
        <br>
        <br>
        <label for="id">Department</label>
        <input type="text" name="dept" id="dept" value="" placeholder="Department">
        <br>
        <br>
        <label for="id">Salary</label>
        <input type="text" name="salary" id="salary" value="" placeholder="Salary">
        <br>
        <br>
        <label for="id">Address</label>
        <input type="text" name="homeaddress" id="homeaddress" value="" placeholder="Address">
        <br>
        <br>
        <input type="submit" name="btn_save" value="Save">
    </div>
</form>
</body>
</html>

I don't know why it is giving me database related error. Because when I try to enter data using a browser, it gets saved inside the database table.

2
  • Aside: Your PHP code is wide open to SQL injection. Don't build queries by sticking strings together or interpolating values. Instead, use prepared statements with parameter binding.
    – Chris
    Commented Apr 18, 2020 at 17:59
  • remove the actual URL to your endpoint if it is in fact the real one. the code you show is vulnerable to SQL injection as @Chris mentions
    – gold_cy
    Commented Apr 18, 2020 at 18:00

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.