mysql - INSERT query in PHP Failing (returns blank error) -

-

this question has answer here:

i'm using following code in attempt insert user-provided values in <form> sql table. when insert query used in phpmyadmin, insertion successful, unsuccessful in following php. connection database successful.

<?php $servername = "localhost"; $username = "***"; $password = "***"; $db_name = "my_db"; $trip; $odom; $gals; $ppg;  if (isset($_request['trip'])){  $trip = $_request['trip']; $odom = $_request['odom']; $gals = $_request['gals']; $ppg = $_request['ppg'];  }   // create connection $conn = mysqli_connect($servername, $username, $db_name, $password);  // check connection if ($conn->connect_error) { die("connection failed: " . $conn->connect_error); } echo "connected ";

here, i've tried using double quotes around query form string; i've omitted quotes well, no avail. also, in values, i've tried both single-quotations , omission thereof well, without success. variables double values, not strings. 

 $vals = "insert `log` (`trip`, `odometer`, `gallons_pumped`,      `price_gallon`)   values ('$trip', '$odom', '$gals', '$ppg')";

the return value of $retval false, no error provided.

$retval = mysql_query($vals);  if ($retval) { echo "new record created successfully"; } else { echo "error: " . $vals . "<br>" . $retval->error; }  mysql_close($conn);  ?>

is syntax incorrect? if not, why insert query unsuccessful?

you're mixing mysqli_* functions mysql_* functions. can't that; aren't same library.

use mysqli_*. please don't use mysql_*; mysql_* functions outdated, deprecated, , insecure. use mysqli or pdo instead.

the last block of code should (untested):

$retval = mysqli_query($vals); // changed  if ($retval) {     echo "new record created successfully"; } else {     echo "error: " . $vals . "<br>" . mysqli_error($conn); // changed }  mysqli_close($conn); // changed

note change $retval->error mysqli_error($conn). definition, if reached point in code because $retval evaluated false , therefore not object.

also, please note wide open sql injection. sql statement this:

$vals = "insert `log` (`trip`, `odometer`, `gallons_pumped`, `price_gallon`) values ('$trip', '$odom', '$gals', '$ppg')";

but values ($trip, etc.) come straight user (via $_request). bad things can happen if user submits values containing, example, ' character. should use prepared statements, this:

$vals = "insert `log` (`trip`, `odometer`, `gallons_pumped`, `price_gallon`) values (?, ?, ?, ?)";  if($stmt = mysqli_prepare($conn, $vals)) {     // adjust "sddd" below match data types; see http://php.net/manual/en/mysqli-stmt.bind-param.php     mysqli_stmt_bind_param($stmt, "sddd", $trip, $odom, $gals, $ppg);      $retval = mysqli_stmt_execute($stmt); } else {     echo "error: " . $vals . "<br>" . mysqli_error($conn); }  mysqli_close($conn);

Comments

Post a Comment

Popular posts from this blog

c++ - llvm function pass ReplaceInstWithInst malloc -

-
#include "llvm/pass.h" #include "llvm/ir/module.h" #include "llvm/ir/function.h" #include "llvm/support/raw_ostream.h" #include "llvm/ir/legacypassmanager.h" #include "llvm/ir/instrtypes.h" #include "llvm/transforms/ipo/passmanagerbuilder.h" #include "llvm/ir/irbuilder.h" #include "llvm/transforms/utils/basicblockutils.h" using namespace llvm; namespace { struct replacepass : public functionpass { static char id; replacepass() : functionpass(id) {} virtual bool runonfunction(function &f) { allocainst* insttoreplace = ??? basicblock::iterator ii(insttoreplace); replaceinstwithinst(insttoreplace->getparent()->getinstlist(), ii, new allocainst(type::int32ty, 0, insttoreplace)); return true; } }; } char replacepass::id = 0; static void registerreplacepass(const passmanagerbuilder &, legacy::passmanagerbase &pm) { pm.add(new re
Read more

java.lang.NoClassDefFoundError When Creating New Android Project -

-
i've tried installing (and re-installing) android studio several times now, , each time, studio isn't able create new android project. when attempt initial android studio window (ie. basic 'create', 'open', 'import' etc options), i'm asked of questions in wizard, brief progress dialog, followed nothing @ all. if open incomplete project process creates choosing 'open' list, can try choosing create new android project menu. this has same issue, error message in output console time... java.lang.noclassdeffounderror: com/sun/xml/internal/bind/v2/model/annotation/annotationreader (wrong name: com/sun/xml/internal/bind/v0/model/qnnotation/annotationreader) note: when installed android studio, installed incompatible jdk (1.8, not 1.7). have had go default project settings change jdk uses 1.8. does know how can avoid this? there place should downloading jxb classes? missing in java paths? this appears have been caused cor
Read more

Decoding a Python 2 `tempfile` with python-future -

-
i'm attempting write python 2/3 compatible routine fetch csv file, decode latin_1 unicode , feed csv.dictreader in robust, scalable manner. for python 2/3 support, i'm using python-future including imporing open builtins , , importing unicode_literals consistent behaviour i'm hoping handle exceptionally large files spilling disk, using tempfile.spooledtemporaryfile i'm using io.textiowrapper handle decoding latin_1 encoding before feeding dictreader this works fine under python 3. the problem textiowrapper expects wrap stream conforms bufferediobase . unfortunately under python 2, although have imported python 3-style open , vanilla python 2 tempfile.spooledtemporaryfile still of course returns python 2 cstringio.stringo , instead of python 3 io.bytesio required textiowrapper . i can think of these possible approaches: wrap python 2 cstringio.stringo python 3-style io.bytesio . i'm not sure how approach - need write such wrapper or 1 ex
Read more