Adding rows to a table from a form

[waverider303]

I have a form on a page called admin.php on that I have the following:

 

admin.php

<form action="process_testimonials.php" method="post"> 
                        <dl> 
                            <dt><label for="testimonials">Testimonials</label></dt> 
                                <dd><textarea name="testimonials" rows="5" cols="50"><? echo $testimonials; ?></textarea></dd> 
                            <dt><label for="from">From</label></dt> 
                                <dd><textarea name="from" rows="3" cols="50"><? echo $from; ?></textarea></dd>
                        </dl> 
                    <div id="buttons"> 
                        <input type="submit" name="submit" value="Add Testimonial" /> 
                    </div> 
                    </form>

 

Then I have it submitting to this php file:

 

process_testimonials.php

<?php

if(empty($_POST)) {
	$status = 'To add a new Testimonial, fill out the form below. Click the Add Testimonial button once.';
	$testimonials = "";
	$from = "";
}
else {
	$testimonials = $_POST['testimonials'];
	$from = $_POST['from'];

	$error_list = array();

	if(empty($testimonials)){
		$error_list[] = 'You did not supply a Testimonials';
	}
	if(empty($from)){
		$error_list[] = 'You did not supply a From';
	}

	if(empty($error_list)){

	include '../connect.php';

	$sql = "INSERT INTO testimonials ";
	$sql .= "SET testimonials='$testimonials', from='$from'";

	if(mysql_query($sql)) {
		header('Location:../login.php');
	}
	else {
		$status='Unable to add post';
	}
} else {
		$status = '<ul>';

		foreach($error_list as $error_message) {
			$status .= "<li>$error_message</li>";
		}
		$status .= '</ul>';
	}
}
?>

 

The problem is passing the variables through. How do i get the values of the text areas into the process_testimonials.php so I can add it to the database.

[lonewolf217]

you did that right here

      $testimonials = $_POST['testimonials'];

      $from = $_POST['from'];

[waverider303]

I get an error at the:

 

$status='Unable to add post';

 

 

[lonewolf217]

well what is the error then?

im guessing its because of your SQL statement

 

read up on the syntax of the INSERT statement

http://www.w3schools.com/SQL/sql_insert.asp

[waverider303]

Idk I have errors displayed but nothing is displayed.

 

I took out the this:

 

else {
         $status='Unable to add post';
      }

 

and replaced with this...

 

else {
         echo "did not INSERT";
      }

 

and it echos that part. What would be wrong with my sql?

[Philip]

Change:

echo "did not INSERT";

to:

echo "did not INSERT", mysql_error();

[lonewolf217]

read the link and see what is wrong with your syntax

 

change

      if(mysql_query($sql)) {
         header('Location:../login.php');
      }

 

to

mysql_query($sql) or die("Error with ".$sql."--".mysql_error());

[waverider303]

Ok i did what you say and this is the error

 

Error with INSERT INTO testimonials (testimonials, from) VALUES (This is my testimonial submited by the form, this is the from submitted by the form)--You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'from) VALUES (This is my testimonial submited by the form, this is the from subm' at line 1

 

and this is what I have for the INSERT INTO statement:

 

$sql = "INSERT INTO testimonials (testimonials, from) VALUES ($testimonials, $from)";

[Philip]

from is a reserved keyword, you'll need to enclose it with backticks.

 

$sql = "INSERT INTO testimonials (testimonials, from) VALUES ($testimonials, $from)";

should be:

$sql = "INSERT INTO `testimonials` (`testimonials`, `from`) VALUES ('$testimonials', '$from')";

 

[waverider303]

ok I got it to work. got me on how the one above doesnt work but here is what I did

 

$sql = "INSERT INTO testimonials VALUES ('', '$testimonials', '$from')";

[waverider303]

but now my problem is....

 

if i have something with an apostrophe " ' " i get the error again. how do I make it escape the apostrophe?