verry simple, but cant find my mistake :/

[loxfear]

heres my code:

 

<?php

$con=mysqli_connect("______________________");

// Check connection

if (mysqli_connect_errno())

  {

  echo "Failed to connect to MySQL: " . mysqli_connect_error();

  }

 

$sql = "INSERT INTO aktiviteter (title, firma, beskrivelse, information, pris, rabat, adresse, by, postnummer, telefon, hjemmeside)

VALUES

('$_POST[title]','$_POST[firma]','$_POST[beskrivelse]','$_POST[information]','$_POST[pris]','$_POST[rabat]','$_POST[adresse]','$_POST[by]','$_POST[postnummer]','$_POST[telefon]','$_POST[hjemmeside]')";

 

if (!mysqli_query($con,$sql))

  {

  die('Error: ' . mysqli_error($con));

  }

echo "Thank you for your participation!";

 

mysqli_close($con);

?>

 

 

 

for some reason it tells me that theres an error, and its not the connection to the server :/

[QuickOldCar]

What's the exact error?

[Jacques1]

Oh man. Your code is wide open to SQL injections. Has it never occured to you that stuffing raw user input into an SQL query string might be a bit ... problematic? It's even sadder given the great security features of MySQLi.

 

You need to start thinking about security.

 

And then it might be a good idea to learn how to use MySQLi.

[bsmither]

I would try two things:

Use backticks to surround all table and column names (avoids accidental use of keywords perhaps such as by)

Use single quotes to surroung names of keys in arrays: $_POST['title']

[Psycho]

The word 'by' is a MySQL Reserved word. You can't reference it in your query without specifically identifying it as a field name (i.e. backticks).

 

But, that the only thing that jumps out at me. Since you were didn't take the time to even supply the error it could be that other errors exist.

 

Fixed the reserved word issue and the SQL Injection hole

 

 

$con = mysqli_connect("______________________");
 
// Check connection
if (mysqli_connect_errno())
{
    echo "Failed to connect to MySQL: " . mysqli_connect_error();
}
 
$sql = sprint_f(
       "INSERT INTO aktiviteter
            (`title`, `firma`, `beskrivelse`, `information`, `pris`, `rabat`,
             `adresse`, `by`, `postnummer`, `telefon`, `hjemmeside`)
        VALUES
            ('%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s')",
        mysqli_real_escape_string($con, $_POST['title']),
        mysqli_real_escape_string($con, $_POST['firma']),
        mysqli_real_escape_string($con, $_POST['beskrivelse']),
        mysqli_real_escape_string($con, $_POST['information']),
        mysqli_real_escape_string($con, $_POST['pris']),
        mysqli_real_escape_string($con, $_POST['rabat']),
        mysqli_real_escape_string($con, $_POST['adresse']),
        mysqli_real_escape_string($con, $_POST['by']),
        mysqli_real_escape_string($con, $_POST['postnummer']),
        mysqli_real_escape_string($con, $_POST['telefon']),
        mysqli_real_escape_string($con, $_POST['hjemmeside'])
        );
 
if (!mysqli_query($con, $sql))
{
    die('Error: ' . mysqli_error($con));
}
echo "Thank you for your participation!";
 
mysqli_close($con);

Edited April 22, 2014 by Psycho

[loxfear]

omg thank you so much .. i will try this tomorrow, even though im sure this works