PHP SQL Форма вставки детали

Question

Можно создать дубликат:
PHP SQL Form Insert

Я сделал форму, чтобы взять вход и вставить их в таблицу. Вместо того, чтобы вставлять значения в таблицу «employee», он вставляет только пароль; это тоже администратор базы данных. Что делать?? Остальные поля остаются пустыми. Любая помощь будет большой.

<?php 
    //include the connection file 

    require_once('connection.php'); 
    require_once("validation.php"); 

    if(isset($_POST['send']) && (!validateName($_POST['name']) || !validateEmail($_POST['email']) || !validatePasswords($_POST['pass1'], $_POST['pass2']) || !validateContact($_POST['contact']) || !validateAge($_POST['age']))):?> 
       <div id="error">  
        <ul> 
         <?php if(!validateName($_POST['name'])):?> 
          <li><strong>Invalid Name:</strong> We want names with more than 3 letters.</li> 
         <?php endif?> 
         <?php if(!validateEmail($_POST['email'])):?> 
          <li><strong>Invalid E-mail:</strong> Type a valid e-mail please.</li> 
         <?php endif?> 
         <?php if(!validatePasswords($_POST['pass1'], $_POST['pass2'])):?> 
          <li><strong>Passwords are invalid:</strong> Passwords doesnt match or are invalid!</li> 
         <?php endif?> 
         <?php if(!validateContact($_POST['contact'])):?> 
          <li><strong>Please enter your contact number.</strong></li> 
         <?php endif?> 
         <?php if(!validateAge($_POST['age'])):?> 
          <li><strong>Please enter your age</strong></li> 
         <?php endif?> 
         </ul> 
       </div> 
      <?php elseif(isset($_POST['send'])):?> 
       <div id="error" class="valid"> 
        <ul> 
        <?php $query = "INSERT INTO employee (name, password, email, contact, age, gender, location, skill) VALUES ";       
        $query .= "('$name', '$password', '$email','$contact','$age','$gender','$location','$skill')"; 
        // run the query 
        mysql_query($query);?> 
         <li><strong>Congratulations!</strong> All fields are OK ;)</li> 
        </ul> 
       </div> 
     <?php endif?> 

Answer 1

Попробуйте это, и вы должны использовать mysql_real_escape_string для предотвращения SQL инъекций ...

<?php 
     //include the connection file 

     require_once('connection.php'); 
     require_once("validation.php"); 

if(isset($_POST['send']) && (!validateName($_POST['name']) || !validateEmail($_POST['email']) || !validatePasswords($_POST['pass1'], $_POST['pass2']) || !validateContact($_POST['contact']) || !validateAge($_POST['age']))):?> 
      <div id="error">  
       <ul> 
        <?php if(!validateName($_POST['name'])):?> 
         <li><strong>Invalid Name:</strong> We want names with more than 3 letters.</li> 
        <?php endif?> 
        <?php if(!validateEmail($_POST['email'])):?> 
         <li><strong>Invalid E-mail:</strong> Type a valid e-mail please.</li> 
        <?php endif?> 
        <?php if(!validatePasswords($_POST['pass1'], $_POST['pass2'])):?> 
         <li><strong>Passwords are invalid:</strong> Passwords doesnt match or are invalid!</li> 
        <?php endif?> 
        <?php if(!validateContact($_POST['contact'])):?> 
         <li><strong>Please enter your contact number.</strong></li> 
        <?php endif?> 
        <?php if(!validateAge($_POST['age'])):?> 
         <li><strong>Please enter your age</strong></li> 
        <?php endif?> 
        </ul> 
      </div> 
     <?php elseif(isset($_POST['send'])):?> 
      <div id="error" class="valid"> 
       <ul> 
       <?php $query = "INSERT INTO employee (name, password, email, contact, age, gender, location, skill) VALUES ";       
       $query .= "('".$_POST['name']."', '".$_POST['pass1']."', '".$_POST['email']."','".$_POST['contact']."','".$_POST['age']."','".$_POST['gender']."','".$_POST['location']."','".$_POST['location']."')"; 
       // run the query 
       mysql_query($query);?> 
        <li><strong>Congratulations!</strong> All fields are OK ;)</li> 
       </ul> 
      </div> 
    <?php endif?> 

Answer 2

Дублированный вопрос ... вот ответ angain:

Я writted полного кода для вас:

<form action="<?php echo $editFormAction; ?>" method="post" name="form1" id="form1"> 
    <table align="center"> 
    <tr valign="baseline"> 
    <td nowrap="nowrap" align="right">Name:</td> 
    <td><input type="text" name="name" value="" size="32" /></td> 
</tr> 
<tr valign="baseline"> 
    <td nowrap="nowrap" align="right">Email:</td> 
    <td><input type="text" name="email" value="" size="32" /></td> 
</tr> 
<tr valign="baseline"> 
    <td nowrap="nowrap" align="right">Pass1:</td> 
    <td><input type="text" name="pass1" value="" size="32" /></td> 
</tr> 
<tr valign="baseline"> 
    <td nowrap="nowrap" align="right">Contact:</td> 
    <td><input type="text" name="contact" value="" size="32" /></td> 
</tr> 
<tr valign="baseline"> 
    <td nowrap="nowrap" align="right">Age:</td> 
    <td><input type="text" name="age" value="" size="32" /></td> 
</tr> 
<tr valign="baseline"> 
    <td nowrap="nowrap" align="right">&nbsp;</td> 
    <td><input type="submit" value="Insert record" /></td> 
</tr> 
</table> 
<input type="hidden" name="id" value="" /> 
<input type="hidden" name="MM_insert" value="form1" /> 
</form> 
<p>&nbsp;</p> 
<?php require_once('../../../Connections/yourconnection.php'); ?> 
<?php 
if (!function_exists("GetSQLValueString")) { 
function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "") 
{ 
if (PHP_VERSION < 6) { 
$theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue; 
} 

$theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue); 

switch ($theType) { 
case "text": 
    $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL"; 
    break;  
case "long": 
case "int": 
    $theValue = ($theValue != "") ? intval($theValue) : "NULL"; 
    break; 
case "double": 
    $theValue = ($theValue != "") ? doubleval($theValue) : "NULL"; 
    break; 
case "date": 
    $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL"; 
    break; 
case "defined": 
    $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue; 
    break; 
} 
return $theValue; 
} 
} 

$editFormAction = $_SERVER['PHP_SELF']; 
if (isset($_SERVER['QUERY_STRING'])) { 
$editFormAction .= "?" . htmlentities($_SERVER['QUERY_STRING']); 
} 

if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] == "form1")) { 
$insertSQL = sprintf("INSERT INTO employee (id, name, email, pass1, contact, age) VALUES (%s, %s, %s, %s, %s, %s)", 
        GetSQLValueString($_POST['id'], "int"), 
        GetSQLValueString($_POST['name'], "text"), 
        GetSQLValueString($_POST['email'], "text"), 
        GetSQLValueString($_POST['pass1'], "text"), 
        GetSQLValueString($_POST['contact'], "text"), 
        GetSQLValueString($_POST['age'], "text")); 

mysql_select_db($database_yourdatabase, $databasename); 
$Result1 = mysql_query($insertSQL, $databasename) or die(mysql_error()); 

$insertGoTo = "sucess.php"; 
if (isset($_SERVER['QUERY_STRING'])) { 
$insertGoTo .= (strpos($insertGoTo, '?')) ? "&" : "?"; 
$insertGoTo .= $_SERVER['QUERY_STRING']; 
} 
header(sprintf("Location: %s", $insertGoTo)); 
} 

mysql_select_db($database_yourdatabase, $databasename); 
$query_query = "SELECT * FROM employee"; 
$query = mysql_query($query_query, $databasename) or die(mysql_error()); 
$row_query = mysql_fetch_assoc($query); 
$totalRows_query = mysql_num_rows($query); 

mysql_free_result($query); 
?> 

Надеется, что это помогает!