My PHP script inputs blank cells in my database

[simrx11]

I'm sure there's a stupid mistake I've made somewhere but since I'm learning from books, troubleshooting is difficult. Here's the code; I censored part of the database connection.

<form method="post" action="polls2.php">
		<p><textarea id="suggestion" name="suggestion"></textarea></p>
		<br />
		<br />
		<input type="submit" value="Submit suggestions" name="submit" />
	</form>

	<?php
	print_r($_POST);
	$suggestion=$_POST['suggestion'];
	$dbc=mysqli_connect('localhost', '(username)', '(password)', '(database)')
	or die('Error connecting to MySQL server.');
	$query="INSERT INTO suggestions(suggestion)".
	"VALUES('$suggestion')";
	$result=mysqli_query($dbc, $query)
	or die('Error querying database.');
	mysqli_close($dbc);
      ?>

[o3d]

Maybe replace the textarea in the form with a static value e.g. <input type="text" value="test123" name="suggestion" /> and submit that and check the table.

[simrx11]

What's the best way to check my database in that case? I'm checking through phpMyAdmin and nothing is coming up after I inputted test values through the application. Is it possible for it to lag? If not I guess it stopped working altogether.

[PFMaBiSmAd]

If the code you posted is all in one file, then every time that page is requested it will insert a row into the database (assuming that a query error does not occur.) So, when you browse to that page the first time, it will insert empty data. When the form is submitted it should insert the data from the form.

 

That form processing code is too minimal. It is not checking that a form was submitted, it is not validating the data from the form, and it is not escaping the data being put into the query to prevent sql injection and to prevent the sql syntax from being broken should there be sql special character in the data.

 

To start with, you should be learning php, developing php code, and debugging php code on a system with error_reporting set to E_ALL and display_errors set to ON in your master php.ini so that php will display all the errors it detects so that php will help you. You will save a ton of time.

 

You also need to get into the habit of using error checking logic (check if something worked or not), error reporting/logging logic (output a useful message when something does not work and either log or immediately display (when in the debugging phase) relevant information about an error so that you can find and fix it), and error recovery logic (what action does your code take when an error occurs) in your code to get your code to tell you when something fails, why it failed, and to take an appropriate action in the program to recover from the error (such as not blindly performing follow-on actions that depend on data from a previous step.)

[simrx11]

It's true, I know that this is a very bare code but the book I've been using builds things up in that way. I plan to tidy things up later on. Would you mind telling me how to alter the php.ini file? I never learned how to do it or why  :-\ I fixed the error in my code, but even when I click the submit button directly it adds a blank cell.

[PFMaBiSmAd]

A) Find the php.ini that php is using. A phpinfo(); statement in a .php file will tell you the php.ini that is being used as the Loaded Configuration File setting.

 

B) Edit the php.ini and find and alter the the error_reporting and display_errors settings to the suggested values.

 

C) Restart your web server to get any change made to the php.ini to take effect.

 

D) Using a phpinfo(); statement in a .php file, confirm that the two settings were actually changed.

[jmajeremy]

Try this:

<?php
if(isset($_POST['submit'])) {
      $suggestion=$_POST['suggestion'];
      $dbc=mysqli_connect('localhost', '(username)', '(password)', '(database)')
      or die('Error connecting to MySQL server.');
      $query="INSERT INTO suggestions(suggestion)".
      "VALUES('$suggestion')";
      $result=mysqli_query($dbc, $query)
      or die('Error querying database.');
      mysqli_close($dbc);
      exit;
}
      ?>
<form method="post" action="polls2.php">
         <p><textarea id="suggestion" name="suggestion"></textarea></p>
         <br />
         <br />
         <input type="submit" value="Submit suggestions" name="submit" />
      </form>
      

[georgebates]

Also a good thing to put into the action part of the form tab is instead of putting the page filename put:

 

<?php $_SERVER['PHP_SELF'] ?>

 

Might help if you change page filename and don't change that

[simrx11]

Thank you to those who corrected my code, I appreciate it. I checked phpinfo(); statement and this is what I got:

Configuration File (php.ini) Path /usr/lib

Loaded Configuration File /usr/local/lib/php.ini

 

I checked, and there's nothing at all in /usr/local/ Is that normal? If I can find it, I think I can manage on my own for a while.