php script wont add record to mysql

Question

The first example will add data to mysql database without any issue. The second block of code - where I try to use variables wont. Can someone please explain where I am going wrong?

<?php
$query  = "INSERT INTO subjects (menu_name,position,visible) VALUES ('Edit me',4,1)";
$result = mysqli_query($connection, $query);

Problem CODE:

<?php
$menu_name = "TEST";
$position = 5;
$visible = 1;

$query  = "INSERT INTO subjects (menu_name,position,visible) 
           VALUES ('{menu_name}',{position}, {visible})";
$result = mysqli_query($connection, $query);

What happens if you use $visible and $position? Are you getting any error messages? — Jim
– Jim, Commented Jan 23, 2015 at 12:01
missing "$" on every single var inside the brackets. {menu_name} should be {$menu_name} and so on, despite you should first PREPARE the string before quering it. Parsing variables directly in the query is dangerous. read more: php.net/manual/en/pdo.prepared-statements.php (BIND parameters) — briosheje
– briosheje, Commented Jan 23, 2015 at 12:02
Thank you so much for your comments. I really appreciate the help. Have absolutely no idea why I failed to add the "$". Woods and trees and all that — RickTicky
– RickTicky, Commented Jan 23, 2015 at 13:17

Dimas Pante · Accepted Answer · 2015-01-23 13:30:28Z

2

*Answer updated with MySQLi prepare statement, thanks @h2ooooooo

<?php
//Open a new connection to the MySQL server
$db = new mysqli('host','username','password','database_name');

//Output connection errors
if ($db->connect_error) {
    die('Error : ('. $db->connect_errno .') '. $db->connect_error);
}

    $sql = "INSERT INTO subjects (menu_name, position, visible) VALUES (?, ?, ?)";

    if (!$stmt = $db->prepare($sql)) {
        echo 'Database prepare error';
        exit;
    }

    $stmt->bind_param('sss', $menu_name, $position, $visible);

    if (!$stmt->execute()) {
        echo 'Database execute error';
        exit;
    }

    $stmt->close();

I'd say for you to take a look in the many tutorials thorugh net, like these:

http://markonphp.com/simple-insert-mysqli/ and

http://www.sanwebe.com/2013/03/basic-php-mysqli-usage

edited Jan 23, 2015 at 13:30

answered Jan 23, 2015 at 12:01

Dimas Pante

2,53124 silver badges31 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

RickTicky Over a year ago

I did not realise this being new to php and MySQL. How do you "bind" variables to prevent malicious SQL statements?

Dimas Pante Over a year ago

Sorry, answer updated now. @RickTicky, take a look in the links also, step-by-step tutorials.

RickTicky Over a year ago

thanks very much! The more I look into this issue, the more important it seems. I appreciate you taking the time to help me and I hope that one day I will have the experience to do the same for others.

habib ul haq · Accepted Answer · 2015-01-23 12:02:20Z

0

$query = "INSERT INTO subjects (menu_name,position,visible) VALUES ('".$menu_name."','".$position."', '".$visible."')";

try this

answered Jan 23, 2015 at 12:02

habib ul haq

8246 silver badges13 bronze badges

Collectives™ on Stack Overflow

php script wont add record to mysql

2 Answers 2

3 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related