Help pls.

[jushiro]

I dont know why my code is not inserting the values..

Someone help pls.

 

<?php
session_start();  
if(isset($_SESSION['owner']) ) {

$con = mysql_connect("localhost","root","");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("feedbackdb", $con);

$from = $_POST['from'];
$type = $_POST['type'];
$feedback = $_POST['feedback'];
$owner = $_SESSION['owner'];


$from = stripslashes($from);
$type = stripslashes($type);
$feedback = stripslashes($feedback);
$owner = stripslashes($owner);

$from = mysql_real_escape_string($from);
$type = mysql_real_escape_string($type);
$feedback = mysql_real_escape_string($feedback);
$owner = mysql_real_escape_string($owner);

		mysql_query("INSERT INTO Feedbacks (Feedback, From, To,  Type,)
		VALUES ('$feedback', '$from', '$owner','$type')") or die(mysql_error);

/*echo '<script type="text/javascript">
{alert("Feedback successfully Added");}
</script>'; 
//echo '<meta http-equiv="REFRESH" content="0;url=Profilepage.php">';*/
}

else {
header("location:buysection.php");;
}
?>

            

[pwntastic]

Hello, you have the following query:

mysql_query("INSERT INTO Feedbacks (Feedback, From, To,  Type,) VALUES ('$feedback', '$from', '$owner','$type')") or die(mysql_error);

after Type you put in a comma although there is nothing else after that

so it should be something like

"SELECT INTO `Feedbacks` (`Feedback`, `From`, `To`, `Type`) VALUES('$feedback', '$from', '$owner', '$type')"

[cpd]

Don't use the root user for the logic of your application and update it with a password. Your open to serious database breaches if you don't have passwords and if anyone were to inject your database they would be doing it with root access...

[Muddy_Funster]

you're not calling your or die properly, it should be :

or die (mysql_error());

see those other brackets?