Like addslashes. Just substitute addslashes with mysql_real_escape_string. But this won’t resolve your problem, it’s just something to improve the script
Please answer 2) and try to do 3) and let us know the results. Ah, and do an echo of $query please.
don’t use addslashes, instead use mysql_real_escape_string
what does error_message() do? and where did you define that function?
you could add some echo’s in ‘thankyou.php’ to see what is executed and what not, and do a print_r of $_POST at the beginning of the script to check its values.
<?
include "config.php";
if($_POST['submit']){
$errors = "";
if (!isset($_POST['firstname']))
$errors .= "Please provide a first name. <br />";
if (!isset($_POST['lastname']))
$errors .= "Please provide a last name. <br />";
if (!isset($_POST['birthdate']))
$errors .= "Please provide a birthdate. <br />";
if (!isset($_POST['email']))
$errors .= "Please provide a email address. <br />";
if (!isset($_POST['phone']))
$errors .= "Please provide a phone number. <br />";
if ($errors == "") {
// query
$query = "INSERT INTO `attendees` (`firstname`,`lastname`,`birthdate`,`email`,`phone`) VALUES('".addslashes($_POST['firstname']) . "','" .addslashes($_POST['lastname']). "','" .addslashes($_POST['birthdate']). "','" .addslashes($_POST['email']). "','" .addslashes($_POST['phone']). "')";
$result = mysql_query($query);
if(!$result) error_message(sql_error());
}
}
?>
<?
// registration checks
if($_POST['submit']){
$errors = "";
if (!isset($_POST['firstname']))
$errors .= "Please provide a first name. <br />";
if (!isset($_POST['lastname']))
$errors .= "Please provide a last name. <br />";
if (!isset($_POST['birthdate']))
$errors .= "Please provide a birthdate. <br />";
if (!isset($_POST['email']))
$errors .= "Please provide a email address. <br />";
if (!isset($_POST['phone']))
$errors .= "Please provide a phone number. <br />";
if ($errors == "") {
// query
$query = "INSERT INTO `attendees` (`firstname`,`lastname`,`birthdate`,`email`,`phone`) VALUES('".addslashes($_POST['firstname']) . "','" .addslashes($_POST['lastname']). "','" .addslashes($_POST['birthdate']). "','" .addslashes($_POST['email']). "','" .addslashes($_POST['phone']). "')";
$result = mysql_query($query);
if(!$result) error_message(sql_error());
}
}
?>
Then you’ll have to move the PHP code at the end of the form to the top of ‘thankyou.php’. Or you’ll have to have the form call the ‘register.php’ script, move the PHP code to the top of the script, and in case of successful registration, redirect to ‘thankyou.php’
The point is, that the entire ‘register.php’ script is executed at once, server side, and then the resulting HTML page (the form) is sent to the browser. Once the user clicks the send button, the script DOES NOT continue at the end of the form. The script called by the form (in this case thankyou.php) is executed (on the server) from the beginning to the end, and the resulting HTML page is sent to the browser.
So, in your case, the part of the script that does the insert is never executed. The first time it isn’t executed because the form hasn’t been submitted yet, and after form submition it isn’t executed because the script that contains the insert code isn’t called.