Mysql query problem

PHP
1 
<?php 
echo "<h1 align='center'>Register</h1>";

$submit = isset($_POST['submit']);

if ($submit){
	$fullname = strip_tags($_POST['fullname']);
	$username = strip_tags($_POST['username']);
	$password = strip_tags($_POST['password']);
	$cpassword = strip_tags($_POST['cpassword']);
	

//Step one Check for existance
	if ($fullname && $username && $password && $cpassword) {
		
		//Step two Password Matching
		if ($password == $cpassword) {
			
			//Step three Checking of character lenghts of the variables
			if (strlen($username)>25 || strlen($fullname)>25) {
				echo "Max limit for username or fullname are 25 characters";
			} else {
				if (strlen($password)>25 || strlen($password)<6){
				echo "Password must be in between 6 to 25 characters";
			} else {
				//Registration Process
				
				//Step four Encryption of password into hash value for security reason.
				$password = md5($password);
		
				//Step Five Connect and select the database.
					// Step 5.1 Connect the database
					$connect = mysql_connect("localhost", "root", "");
					//Step 5.2 Select the Database
					mysql_select_db("learning", $connect);
				
				//Step 6 Query the database and inster the data into the databse.
					//Step 6.1 Query the database
					$querry	="INSERT INTO users (name, username, password) 
										VALUES ('{$fullname}', '{$username}, '{$password}')";						
													
					mysql_query($querry, $connect);
					
					die("Congratulation! You have been registered. <br ><a href='index.php'>Click here</a> to return to login page. Thank you!");
				
			} //End of "else {//Registration Process"
			}
		}//End of if ($password == $cpassword) {
		else {
			echo "Your password fields do not match, please try again";
		}		
	}//End of if ($fullname && $username && $password && $cpassword) {
	else { 
		echo "Please fill in all the fields";
	}
}// End of if ($submit){

?>

<html>
<body>
<form action="register.php" method="post">
	<table>
    	<tr>
        	<td>
            	Your Full Name:    
            </td>
            <td>
            	<input type="text" name="fullname">
            </td>
        </tr>
        <tr>
        	<td>
            	Choose Username:    
            </td>
            <td>
            	<input type="text" name="username">
            </td>
        </tr>
        <tr>
        	<td>
            	Choose Password:    
            </td>
            <td>
            	<input type="password" name="password">
            </td>
        </tr>
        <tr>
        	<td>
            	Confirm Password:    
            </td>
            <td>
            	<input type="password" name="cpassword">
            </td>
        </tr>
  </table>
<div>
  <input type="submit" name="submit" value="Proceed in!" />
</div>

</form>
</body>
</html>

I’m unable to insert any data into mysql database, and I’m not able to figure out any problem neither this is showing any error message. I’m stuck, not able to login in with my new registered ids, as in the time of login in says no such user exists. So in all this scipt is unable to insert any data into the database.

2

Try changing your connect and query statements like this to see errors:


$connect = mysql_connect("localhost", "root", "") or die('Connect failed: ' . mysql_error());
...
...
mysql_query($querry, $connect) or die('Query failed: ' . mysql_error());
3

Thanx buddy

it was really a very silly and funny mistake… haha :lol:

But it took my 1 hr too and still I was not able to solve it… u are the savior. It was just a very minor mistake.

4

Consider sanitizing form input, or you’ll be in danger of sql injection.
for mysql functions you’re using it will be mysql_real_escape_string() function that must be applied to every literal going to database.

But it took my 1 hr too and still I was not able to solve it… u are the savior. It was just a very minor mistake.

With proper error reporting you’ll spot it in a second.
error_reporting(E_ALL) is the least acceptable level

5

cools_sonu, have a read of this, it explains what sql injection is and a number of of other security related things.

6

hi friend you are used wrong syntax on this line
$querry ="INSERT INTO users (name, username, password)

                                    VALUES ('{$fullname}', '{$username}, '{$password}')"

use like this

$querry =“INSERT INTO users (name, username, password) VALUES (‘$fullname’, '$username, ‘$password’)”;

dont use {} in value field.

7

These braces unnecessary here, but not a wrong syntax. They belongs to PHP syntax, not SQL and will be replaced with actual variable content.

8

After the line:

 $querry    ="INSERT INTO users (name, username, password)  
                                        VALUES ('{$fullname}', '{$username}, '{$password}')";

add this line:

echo $querry;

Does the echoed query contain the values that your are expecting?