PHP Contact Form

[greenelephant]

HELLO EVERYONE

I HAVE A HTML FORM ON A HTML PAGE FOR USE AS A FEEDBACK FORM.
I WANT TO WRITE THE USER-ENTERED DETAILS INTO A MYSQL DATABASE
I AM USING A WEB HOSING SERVICE WHO HAVE TOLD ME THAT TO CONNECT TO THE DATABASE I NEED TO USE PDO (PHP DATABASE OBJECT).
HERE IS MY PRESENT PHP CODING TO DO THIS TASK AS OF DATE:
 

<?php

if(isset($_POST['email'])) {

function died($error) {

// your error code can go here

echo "We are very sorry, but there were error(s) found with the form you submitted. ";

echo "These errors appear below.<br /><br />";

echo $error."<br /><br />";

echo "Please go back and fix these errors.<br /><br />";

die();

}

// validation expected data exists

if(!isset($_POST['firstname']) ||

!isset($_POST['lastname']) ||

!isset($_POST['email']) ||

!isset($_POST['telephone']) ||

!isset($_POST['bustype']) ||

!isset($_POST['description'])) {

died('We are sorry, but there appears to be a problem with the form you submitted.');

}

$firstname = $_POST['firstname']; // required

$lastname = $_POST['lastname']; // required

$email = $_POST['email']; // required

$telephone = $_POST['telephone']; // not required

$bustype = $_POST['bustype']; // required

$description = $_POST['description']; // required

$con = new PDO("mysql:host=mysql.hostinger.in;dbname=databasename",'username', 'password');

$query = "INSERT INTO `databasename` (`id`, `firstname`, `lastname`, `bustype`, `email`, `telephone`, `description`, `timestamp`,) VALUES (NULL, '$firstname', '$lastname', '$bustype', '$email', '$telephone', '$description', CURRENT_TIMESTAMP,)";

$q = $con->prepare($query);
$q->execute(array(':$firstname' => $_POST['firstname'], ':$lastname' => $_POST['lastname'], ':$bustype' => $_POST['bustype'], ':$email' => $_POST['email'],':$telephone' => $_POST['telephone'], ':$description' => $_POST['description'], ));

echo "<h2>Thank you for filling in our contact. We shall get back to you as soon as possible.</h2>";
$con = null;

?>

but I AM GETTING AN ERROR MESSAGE WHEN I TRY TEST THE HTML FORM PAGE WHICH SAYS
 

PHP Code:

Parse error: syntax error, unexpected $end in /home/u196883532/public_html/form.php on line 69 

PLUS THERE IS NO DATA WRITTEN TO THE DATABASE. I NEED HELP. WHAT CAN I DO? THANKS

[cyberRobot]

It looks like you're missing a close curly quote at the end of your script.

<?php
//...
 
    $con = null;
}
?>

[cyberRobot]

Also note that the form variables are being added directly to the query. To use the named parameters defined in $q->execute(), you should change this:

... VALUES (NULL, '$firstname', ...

To this:

... VALUES (NULL, ':$firstname', ...

Note that I'm not very familiar with PDO, so hopefully someone will correct me if the syntax is incorrect. More information about preparing queries can be found here:

http://php.net/manual/en/pdo.prepare.php

[greenelephant]

Brilliant.

Thanks for you help.

 

This has resolved the error code. But there is no data being written to the database. what shall i do?

[scootstah]

Proper code styling can go a long way to not only prevent them, but make finding errors like these much, much easier.

 

Consider the following adjustments to your code:

<?php

if(isset($_POST['email'])) {
    function died($error) {
        // your error code can go here
        echo "We are very sorry, but there were error(s) found with the form you submitted. ";
        echo "These errors appear below.<br /><br />";
        echo $error."<br /><br />";
        echo "Please go back and fix these errors.<br /><br />";
        die();
    }

    // validation expected data exists

    if 
        (
            !isset($_POST['firstname'])   ||
            !isset($_POST['lastname'])    ||
            !isset($_POST['email'])       ||
            !isset($_POST['telephone'])   ||
            !isset($_POST['bustype'])     ||
            !isset($_POST['description'])
        )
    {
        died('We are sorry, but there appears to be a problem with the form you submitted.');
    }

    $firstname   = $_POST['firstname'];   // required
    $lastname    = $_POST['lastname'];    // required
    $email       = $_POST['email'];       // required
    $telephone   = $_POST['telephone'];   // not required
    $bustype     = $_POST['bustype'];     // required
    $description = $_POST['description']; // required

    $con = new PDO("mysql:host=mysql.hostinger.in;dbname=databasename",'username', 'password');

    $query = 
        "INSERT INTO `databasename` " .
        "(`id`, `firstname`, `lastname`, `bustype`, `email`, `telephone`, `description`, `timestamp`,) " .
        "VALUES " .
        "(NULL, '$firstname', '$lastname', '$bustype', '$email', '$telephone', '$description', CURRENT_TIMESTAMP,)"
    ;

    $q = $con->prepare($query);
    $q->execute(array(
        ':$firstname'   => $_POST['firstname'],
        ':$lastname'    => $_POST['lastname'],
        ':$bustype'     => $_POST['bustype'],
        ':$email'       => $_POST['email'],
        ':$telephone'   => $_POST['telephone'],
        ':$description' => $_POST['description'], 
    ));

    echo "<h2>Thank you for filling in our contact. We shall get back to you as soon as possible.</h2>";
    $con = null;
}

This is much easier to read. It's a lot harder to here to miss brackets, because everything is properly indented.

 

If you're interested, I'd recommend you check out the PSR-2 style guide.

[scootstah]

  On 1/23/2015 at 4:19 PM, cyberRobot said:

Also note that the form variables are being added directly to the query.

No they're not, they're in single quotes.

 

  On 1/23/2015 at 4:19 PM, cyberRobot said:

To use the named parameters defined in $q->execute(), you should change this:

... VALUES (NULL, '$firstname', ...

To this:

... VALUES (NULL, ':$firstname', ...

Note that I'm not very familiar with PDO, so hopefully someone will correct me if the syntax is incorrect. More information about preparing queries can be found here:

http://php.net/manual/en/pdo.prepare.php

 

You should get rid of the $. Like so:

... VALUES (NULL, ':firstname', ...

...

$q->execute(array(':firstname' => $_POST['firstname'], ...

Edited January 23, 2015 by scootstah

[cyberRobot]

  On 1/23/2015 at 4:28 PM, scootstah said:

No they're not, they're in single quotes.

 

The overall query is in double quotes though.

$query = "INSERT INTO `databasename` (`id`, `firstname`, `lastname`, `bustype`, `email`, `telephone`, `description`, `timestamp`,) VALUES (NULL, '$firstname', '$lastname', '$bustype', '$email', '$telephone', '$description', CURRENT_TIMESTAMP,)";

[scootstah]

  On 1/23/2015 at 4:31 PM, cyberRobot said:

The overall query is in double quotes though.

Haha, doh!

 

Time for a coffee refill.

[cyberRobot]

  On 1/23/2015 at 4:21 PM, greenelephant said:

This has resolved the error code. But there is no data being written to the database. what shall i do?

 

Have you checked to see if any MySQL errors are being thrown? More information on how to do that can be found here:

http://php.net/manual/en/pdo.errorinfo.php

[CroNiX]

There's also no php function called "died()", it's "die()".

[cyberRobot]

  On 1/23/2015 at 5:04 PM, CroNiX said:

There's also no php function called "died()", it's "die()".

 

It's a user-defined function defined near the top of the script.

function died($error) {
    //...
}

[CroNiX]

Oh I missed that. Don't see the use of creating a function if it's only going to be used once. Might as well just write the code where it's used.