php form mysql issue

[ianhaney]

Hi

I have created a form that allows my clients visitors to sign up and it stored the values in a mysql database but for some reason the form just resets itself and does not give any error reporting issue as have that in the coding and does not save into the database, below is PHP coding

<?php
ini_set('display_startup_errors',1);
ini_set('display_errors',1);
error_reporting(-1);
?>

<?php 
$title = "Sign Up - Micromend";

$pgDesc="";

$pgKeywords="";

include ( 'includes/header.php' );
?>
<!--CONTENT-->

<div id="column-whole-inner">
<div id="login">
<h2>Visitor's Form</h2>
<br />
<form action="" method="post">
<label>Name :</label>
<input type="text" name="vis_name" id="name" required placeholder="Please Enter Name"/>
<br /><br />
<label>Email :</label>
<input type="email" name="vis_email" id="email" required placeholder="john123@gmail.com"/>
<br/><br />
<label>Address Line 1 :</label>
<input type="text" name="vis_firstline" id="firstline" required placeholder="Please Enter First Line of your address"/>
<br><br>
<label>Address Line 2 :</label>
<input type="text" name="vis_secondline" id="secondline" required placeholder="Please Enter Second Line of your address"/>
<br><br>
<label>Town :</label>
<input type="text" name="vis_town" id="town" required placeholder="Please Enter your Town"/>
<br><br>
<label>County :</label>
<input type="text" name="vis_county" id="county" required placeholder="Please Enter Your County"/>
<br/><br />
<label>Postcode :</label>
<input type="text" name="vis_postcode" id="postcode" required placeholder="Please Enter Your Postcode"/>
<br><br>
<label>Telephone Number :</label>
<input type="text" name="vis_tel" id="tel" required placeholder="Please Enter Your Telephone Number"/>
<br><br>
<label>Mobile Number :</label>
<input type="text" name="vis_mobile" id="mobile" required placeholder="Please Enter Your Mobile Number"/>
<br><br>
<label>Receive our Monthly Newsletter :</label>
<br>
<input type="radio" name="vis_newsletter" value="Yes">Yes
<br>
<input type="radio" name="vis_newsletter" value="No">No
<br><br>
<input type="submit" value=" Submit " name="submit"/>
<br />
</form>
</div>

</div>
<?php
if(isset($_POST["submit"])){
$servername = "";
$username = "";
$password = "";
$dbname = "";

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}

$sql = "INSERT INTO visitors (visitor_name, visitor_email, visitor_firstline, visitor_secondline, visitor_town, visitor_county, visitor_postcode, visitor_tel, visitor_mobile, visitor_newsletter)
VALUES ('".$_POST["vis_name"]."','".$_POST["vis_email"]."','".$_POST["vis_town"]."','".$_POST["vis_county"]."','".$_POST["vis_postcode"]."','".$_POST["vis_tel"]."','".$_POST["vis_mobile"]."','".$_POST["vis_newsletter"]."'')";

if ($conn->query($sql) === TRUE) {
echo "<script type= 'text/javascript'>alert('Your Information has been added successfully to our database');</script>";
} else {
echo "<script type= 'text/javascript'>alert('Error: " . $sql . "<br>" . $conn->error."');</script>";
}

$conn->close();
}
?>

<!--CONTENT-->

<?php include( 'includes/footer.php' ); ?>

Don't think I have missed anything as it seems to connect to the database ok and don't get a connection error

Thank you in advance

Ian

[ianhaney]

Sorry was me being silly, I sussed it and works perfect now

[mutago]

Hey, your code is vulnerable to sql injection attack. Try escape your variable using Mysqli_real_escape_string()