0

I have a PHP script that is inserting a record into a database after getting the data from a user-filled form. I developed on my local machine (WAMP server) and have the following code in my PHP script:

$name = mysql_real_escape_string($_POST['name']);
        $email = mysql_real_escape_string($_POST['email']);

        //connecting to db
        mysql_connect("host", "user", "pass") or die('save_failed');
        mysql_select_db("db") or die('save_failed');

        //inserting into table
        mysql_query("INSERT INTO table(name, email) VALUES('" . $name . "', '" . $email . "' ) ") 
        or die('save_failed');  

The script worked just as expected and the records were being successfully inserted into the table.

As soon as I moved the script to my webserver, I realized the values being stored in the database were empty strings. Removing mysql_real_escape_string fixed this.

Why is it that mysql_real_escape_string won't work on my webserver?

The database I'm working on hasn't changed. Even when developing locally, I was hitting my webserver DB. PHP ver on localhost is 5.3.8 while on the webserver it is 5.2.

Does PHP 5.2 not support mysql_real_escape_string, and if so what is the alternative?

2
  • Why all error messages are called save_failed? How do you determine whether it was the connection, select database statement or insert query that failed?
    – Salman A
    Oct 18, 2011 at 7:10
  • I'm not too worried about that because those errors should be logged in the php log files (unless i'm mistaken)
    – Ayush
    Oct 18, 2011 at 9:35

3 Answers 3

4

Put mysql_connect("host", "user", "pass") or die('save_failed'); before mysql_real_escape_string.

1
  • oh, wow...yeah. had no idea that function depended on a mysql connection. Thank you.
    – Ayush
    Oct 18, 2011 at 7:05
2

You first need to connect to the database, then mysql_real_escape your strings. I suspect it works locally because PHP and your database are configured so they can automatically establish a connection when needed.

http://www.php.net/mysql_real_escape_string

If the link identifier is not specified, the last link opened by mysql_connect() is assumed. If no such link is found, it will try to create one as if mysql_connect() was called with no arguments. If no connection is found or established, an E_WARNING level error is generated.

Apparently you should also activate error reporting and/or check your error logs.

0

From the manual page for mysql_real_escape_string():

Parameters

unescaped_string: The string that is to be escaped.

link_identifier: The MySQL connection. If the link identifier is not specified, the last link opened by mysql_connect() is assumed. If no such link is found, it will try to create one as if mysql_connect() was called with no arguments. If no connection is found or established, an E_WARNING level error is generated.

Your code uses mysql_real_escape_string() before calling mysql_connect(). That means that PHP is trying to open a connection to the MySQL server before than you think and you are not providing credentials or doing error checking. If it works in your development box, it's probably pure chance: your local server has default credentials at php.ini or a password-less MySQL account.

Move the connecting to db part to the top and you're done.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.