rawdata Posted January 11, 2016 Share Posted January 11, 2016 Can anyone see where I have erred? No errors of any kind.Here's the form: <form name="news" action="updateNews.php" method="post"> <p>Click "Clear" Button to remove old events.</p> <input type="submit" id='delete' name="delete" value='Clear' /><br /><br /><br /> <input type="text" name="dateof" /> Enter date of Event (abbreviate month)<br /> <input type="text" name="event" /> Enter name of Event<br /> <input type="text" name="title" /> Enter time of Event and misc. info.<br /><br /> <input type="submit" name="add" value="Add Event" /><br /><br /> </form> Here's my php: <?php error_reporting(E_ALL); ini_set('display_errors', 1); //Hook up include('db.php'); //Delete old news if(isset($_POST['delete'])){ $query = "TRUNCATE TABLE `news` "; $result = mysqli_query($link,$query) or die('Error deleting table.'); } if(isset($_POST['add'])){ //Get the goods $dateof = $_POST['dateof']; $event = $_POST['event']; $title = $_POST['title']; //Insert the goods $query = "INSERT INTO news (dateof, event, title) VALUES('$dateof', '$event', '$title')"; $result = mysqli_query($link, $query) or die('Update Failed' .mysqli_error($link)); } db.php is just my connection file: <?php /* Database Information - Required!! */ /* -- Configure the Variables Below --*/ $dbhost = 'localhost'; $dbusername = ''; $database = ''; $dbpasswd = ''; /* Let's get connected*/ $link = mysqli_connect("$dbhost", "$dbusername", "$dbpasswd", "$database"); /* Now check that we're connected */ if (mysqli_connect_errno()) { printf("Connect failed: %s\n", mysqli_connect_error()); exit(); } Quote Link to comment Share on other sites More sharing options...
Solution rawdata Posted January 11, 2016 Author Solution Share Posted January 11, 2016 Nevermind, I was trying to use an apostrophe without escaping it. Quote Link to comment Share on other sites More sharing options...
Barand Posted January 12, 2016 Share Posted January 12, 2016 You should use prepared queries. It avoids that sort of problem. 1 Quote Link to comment Share on other sites More sharing options...
Muddy_Funster Posted January 12, 2016 Share Posted January 12, 2016 As said, you should be using prepared statments. Not only does it mitigate the escaping issue but dropping raw $_POST values into an SQL query is a mahoosive security hole. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.