NEED PHP MYSQL HELP!!! - Thank you :) - WebDeveloper.com Forums

This site is best viewed in a modern browser with JavaScript enabled.

NEED PHP MYSQL HELP!!! - Thank you :)

stormdart

Whenever I process the code below, I recieve the output; Query was empty. What does this mean, how can I fix it?

<?PHP
@include 'include/mysql.php';
@include 'include/global.php';

$cur_date = date("d/m/y H:i:s", time());

mysql_query("INSERT INTO MESSAGES (RECIPIENT, FROM, DATE, SUBJECT, MESSAGE, STATUS, TYPE)
VALUES ($_POST[RECIPIENT], $_POST[FROM], $cur_date, $_POST[SUBJECT], $_POST[MESSAGE], 1, 2)");

$result = mysql_query($query) or die(mysql_error());

?>

Cheers.

Mindzai

You don't assign a value to $querry so you are essentially passing null to mysql_query.

stormdart

hi,

did you mean in the die function? because the script still doesn't work when i take it out - I just put it there to identify the problem.

ssystems

Should be

$query = "INSERT INTO MESSAGES (RECIPIENT, FROM, DATE, SUBJECT, MESSAGE, STATUS, TYPE)
VALUES ($_POST[RECIPIENT], $_POST[FROM], $cur_date, $_POST[SUBJECT], $_POST[MESSAGE], 1, 2)";

$result = mysql_query($query) or die(mysql_error());

I haven't checked the syntax of the query but I guess that would clarify what Mindzai is talking about. Good Luck

Santos Systems

Yelgnidroc

You need:

$result = mysql_query("INSERT INTO MESSAGES (RECIPIENT, FROM, DATE, SUBJECT, MESSAGE, STATUS, TYPE)
VALUES ($_POST[RECIPIENT], $_POST[FROM], $cur_date, $_POST[SUBJECT], $_POST[MESSAGE], 1, 2)") or die(mysql_error());

Although normally you would do something like:

$query = "INSERT INTO MESSAGES (RECIPIENT, FROM, DATE, SUBJECT, MESSAGE, STATUS, TYPE)
VALUES ($_POST[RECIPIENT], $_POST[FROM], $cur_date, $_POST[SUBJECT], $_POST[MESSAGE], 1, 2)";

$result = mysql_query($query) OR die(mysql_error());

Don't forget to sanitise your $_POST inputs otherwise you'll be open to hackers.

Also, database text variables needs quotes around them when inserting e.g.
$POST[SUBJECT] should be '$POST[SUBJECT]'

Yelgnidroc

PS you can use mysqls NOW() instead of using php to get the current date. I would call your date column date - I think it's a reserved keyword (although I haven't double checked)

ssystems

Yelgnidroc;1042782 wrote:
PS you can use mysqls NOW() instead of using php to get the current date. I would call your date column date - I think it's a reserved keyword (although I haven't double checked)

Here's the list for Reserved Words

Good Luck

Santos Systems

Yelgnidroc

Oops, I meant I wouldn't use it.

Although as ssystems has pointed out it's NOT a keyword.

I still wouldn't use date though, I'd call it message_date or something more meaningful

stormdart

FROM is a reserved keyword, this may also be a problem ! ha!

ssystems

stormdart;1042792 wrote:
FROM is a reserved keyword, this may also be a problem ! ha!

meaningful names would really help

stormdart

sanitise?

Mindzai

There is nothing stopping you from using reserved words as long as you enclose them in backticks, though as others have said it's usually best to avoid them if possible.

ssystems

stormdart;1042794 wrote:
sanitise?

He basically meant to make sure the post values are not a danger to your database. example is appending "OR 1" to the post value etc. Would wanna check this out. Good Luck.

Santos Systems

stormdart

so ive got this now:

$sql = "INSERT INTO MESSAGES (RECIPIENT, SENDER, DATE_1, SUBJECT, MESSAGE, STATUS, TYPE)
VALUES ('$_POST[RECIPIENT]', '$_POST[SIGNATURE]', '$cur_date', '$_POST[SUBJECT]', '$_POST[MESSAGE]', '1', '2')";

header( 'Location: /?sent=1' ) ;

it doesnt work - took the die script out because I thought it would work now.

Yelgnidroc

I don't think you want the following with quotes round them - I'm guessing they are INT's or FLOAT's

'1', '2')

You also need to run your query:

$result = mysql_query($sql);

Yelgnidroc

Have you got phpMyAdmin?

If so run your query through that to test.

stormdart

sorry, this is what ive got:

$query = "INSERT INTO MESSAGES (RECIPIENT, SENDER, DATE_1, SUBJECT, MESSAGE, STATUS, TYPE)
VALUES ('$_POST[RECIPIENT]', '$_POST[SIGNATURE]', '$cur_date', '$_POST[SUBJECT]', '$_POST[MESSAGE]', 1, 2)";

$result = mysql_query($query) OR die(mysql_error());

header( 'Location: /?sent=1' ) ;

it works, thank you for your help

ssystems

Don't forget to mark as resolved

Yelgnidroc

Excellent.

We'll send you the bill - lol

Don't forget to read up about sql injection (as previously mentioned).