[SOLVED] Why is blank data being inserted into my database?

[nscherneck]

<form action="" method="get">
<p>Name: <input name="Name" type="text"></p>
<p>Rate: <input name="Rate" type="text"></p>
<input name="" type="submit" onClick="<?php 
$put = "INSERT INTO Employees VALUES ('','$Name','$Rate')";
mysql_query($put, $connection); ?>">
</form>

 

this form inserts data into my mysql database, but everytime the page is refreshed blank data gets inserted.  my thought is that the PHP code would only execute "onClick" of the button.  am i wrong?

[Illusion]

the variables should be $_GET['Name'] and $_GET['Rate'], I don't know why u r using get method and ur code doesn't look good.

[vijayfreaks]

Hi..

    use following code for this:

<!-- ASSUME THIS FILENAME IS "test.php"--->
<form action="" method="post">
<p>Name: <input name="Name" type="text"></p>
<p>Rate: <input name="Rate" type="text"></p>
<input name="submit" type="submit" value="submit">
</form>

<?php 
if(issset($_POST['submit']) && $_POST['submit'] == 'submit')
$put = "INSERT INTO Employees VALUES ('','$Name','$Rate')";
mysql_query($put, $connection); 
header("location:test.php");
exit;
?>

 

Regards,

vijay

[nscherneck]

Ill give this a shot in a few minutes.  Can you guys give me a little education into why to use POST instead of GET?  Thanks!

[Illusion]

Get method appends the values what ur submitting in the form to the URL so its not secure as user can append any data(google SQL injection) there if u r not doing proper validation apart from that if u use get method the end user can easily bookmark that one. Post method doesn't show the values in URL.

why I suggested post method is u r using those variables in insert statement.

Just imagine the user has bookmarked the page and each time he visited it insert duplicate values if u r not taken proper care.

[akitchin]

the reason you were getting empty entries is because the PHP code was being executed EVERY TIME.  it is always processed BEFORE the HTML.  it cannot be used as a client-side language (note that an onclick event is a client event, not a server event).  vijay's code should amend that, but i figured i'd explain why it was inserting empty rows.

[nscherneck]

my understanding is that you cannon call the header() function after any other code has been parsed.  am i wrong?

 

 

[nscherneck]

Illusion, akitchin

 

thank you for clearing those things up for me.