Inserting Session Variables Into Mysql

[wright67uk]

I'm trying to insert some form results into a table. I've tested my connection, and the query echos out fine.

 

I understand that, I need to sanitize my variables, but for now I'm trying to figure out why nothing gets inserted into my database.

 

Does my code seem to be ok, or is this most likely down to the way my table has been setup?

 

<?php session_start();

include 'connection.php';

$insert_query = ("insert into users(name, email, phone, postcode, type, start, user, password, tac) values ( " . $_SESSION['name'] . ", " . $_SESSION['email'] . ", " . $_SESSION['phone'] . ", " . $_SESSION['postcode'] . ", " . $_SESSION['type'] . ", " . $_SESSION['start'] . ", " . $_POST ['user'] . ", " . $_POST ['password'] . ", " . $_POST ['tac'] . " ) ") or die(mysql_error());

echo "Data Inserted!"; echo $insert_query;

mysql_query($insert_query);

?>

[requinix]

Strings in SQL need quotes.

[wright67uk]

So more like the below?

<?php
   session_start();

include 'connection.php';

$insert_query = ("insert into users('name', 'email', 'phone', 'postcode', 'type', 'start', 'user', 'password', 'tac')
values (
               " . $_SESSION['name']     . ",
               " . $_SESSION['email']    . ",
               " . $_SESSION['phone']    . ",
               " . $_SESSION['postcode'] . ",
			" . $_SESSION['type']     . ",
			" . $_SESSION['start']    . ",
               " . $_POST   ['user']     . ",
               " . $_POST   ['password'] . ",
               " . $_POST   ['tac']      . "   )
                                                ") or die(mysql_error());

echo "Data Inserted!";
echo $insert_query;

mysql_query($insert_query); 		

?>

[requinix]

Right idea, wrong place. Quotes around the strings you're inserting. The list of fields you're inserting into don't always have to be quoted, but if you do then use backticks ` for them. Regular double " and single ' quotes are strictly (and necessary) for string values.

INSERT INTO table (field1, field2, field3) VALUES ("string 1", "string 2", "string 3")

INSERT INTO table (`field`, `field2`, `field3`) VALUES ('string 3', 'string 4', 'string 5')

[wright67uk]

" . $_SESSION['name'] . ", sorry if this isn't sinking in, but are you saying I should have more quotes around the example?

[requinix]

No, I'm saying you put the quotes in the wrong place. Compare where the quotes are in the examples I posted with where the quotes are in your code.

[NomadicJosh]

Also, I want to suggest using a function like:

 

function isSessionSet($caller) {
if(isset($_SESSION[$caller])) {
return $_SESSION[$caller];
}
}

 

How to use:

$query = "insert into users(name, email) values ( '" . isSessionSet('name') . "', '" . isSessionSet('email') . "' )" or die(mysql_error());

 

This will prevent your error logs from being crowded with unnecessary "index" errors.

Edited December 1, 2012 by parkerj