admin panel help

[fantomel]

hello i've got some problems with a code from an admin panel i'm begginer in doing stuff like this one .. can someone help me with the code cuz.. it doesn't insterting the right stuff and i dunno why i can't understand... thanks for helping me out

 

 

 

<form method="POST" action="locatie_add.php">
<table>
   <tr>
      <td>Titlu: </td>
      <td><input type="text" name="title"></td>
   </tr>
   <tr>
       <td>Tara: </td>
       <td><input type="text" name="tara"></td>
   </tr>
   <tr>
       <td>Locatie: </td>
       <td><input type="text" name="locatie"></td>
   </tr>
   <tr>
       <td></td>
       <td><input type="submit" value="submit"></td>
   </tr>
</table>
</form>

 

 

 

 

<?php    
$title = $_POST['title'];  
$tara = $_POST['tara'];  
$locatie = $_POST['locatie'];  
  
$sql = "insert into vacante_locatii (title, tara, locatie) VALUES ('$title', '$tara', '$locatie')";  
if (!$sql) {
    die('Nnu am putut adauga nimic. ' . mysql_error());
    echo ("am reusit");
   }
$result = mysql_query($sql) or die ( mysql_error() );
?>  

 

 

 

 

CREATE TABLE IF NOT EXISTS `vacante_locatii` (
  `vacante_locatii_id` tinyint(11) unsigned NOT NULL auto_increment,
  `title` varchar(30) NOT NULL,
  `tara` text NOT NULL,
  `locatie` text NOT NULL,
  PRIMARY KEY  (`vacante_locatii_id`)
) ENGINE=MyISAM  DEFAULT CHARSET=latin1 AUTO_INCREMENT=31 ;

[LemonInflux]

Right, for a start...

 

<?php    
$title = $_POST['title'];  
$tara = $_POST['tara'];  
$locatie = $_POST['locatie'];  
  
$sql = "insert into vacante_locatii (title, tara, locatie) VALUES ('$title', '$tara', '$locatie')";  
if (!$sql) {
    die('Nnu am putut adauga nimic. ' . mysql_error());
    echo ("am reusit"); // <- this line isn't needed. You called the die() function, so nothing after this will work.
   }
$result = mysql_query($sql) or die ( mysql_error() );
?>  

 

Why not use..

 

<?php    
$title = mysql_real_escape_string($_POST['title']); // by using mysql_real_escape_string, this combats mysql injection hacking 
$tara = mysql_real_escape_string($_POST['tara']);
$locatie = mysql_real_escape_string($_POST['locatie']);

$sql = mysql_query("INSERT INTO `vacante_locatii` (title, tara, locatie) VALUES ('$title', '$tara', '$locatie')") or die('Nnu am putut adauga nimic. ' . mysql_error()); // A bit tidier. Also, your if(!sql) will never be called, because there you're checking if the var was set, not whether the query was successful.

?>

 

Tell me if you have any luck

 

[LemonInflux]

Oops, my code needed tweaking. Fixed

[fantomel]

thanks for helping me out it works thanks for helping me out