php - cant insert data to just one of my mysql table -
i developing website , funny thing can insert data table except 1 of table.
php part
function newproperty(){ global $link; if(isset($_post['sendprop']) && $_post['agree'] == 'yes'){ $name=mysqli_real_escape_string($link,$_post['name']); $owner=mysqli_real_escape_string($link,$_post['owner']); $tel=mysqli_real_escape_string($link,$_post['tel']); $email=$_session['cust_user']; $type=$_post['type']; $loc=$_post['location']; $address=mysqli_real_escape_string($link,$_post['address']); $bed=$_post['bed']; $price=$_post['price']; $descrip=mysqli_real_escape_string($link,$_post['desc']); $temp = explode(".", $_files["pic"]["name"]); $thumb = round(microtime(true)) . '.' . end($temp); move_uploaded_file($_files["pic"]["tmp_name"], 'assets/propthumb/'.$thumb); $query="insert property (prop_name, prop_email, prop_owner, prop_tel, prop_type, prop_location, prop_bed, prop_price, prop_thumb, prop_desc, prop_address) values ('$name','$email','$owner', '$tel','$type','$loc', '$bed','$price','$thumb', '$descrip','$address')"; $run=mysqli_query($link,$query); if($run){ echo"<script>alert('property has been inserted successfully');</script>"; echo"<script>window.open('list.php','_self');</script>"; } } } html part
<form action="submit.php" method="post" enctype="multipart/form-data"> <div class="container bgsearch shadow"> <div class="container-fluid "> <br> <div class="row"> <div class="col-lg-10 col-lg-offset-1"> <img src="assets/images/hero1.png" class=" img-responsive"> </div> </div> <div class="row"> <div class="col-lg-8 col-lg-offset-2"> <h3 class="wtxt text-center">submit property</h3> <br> <hr id="hr"> </div> </div> <div class="row"> <div class="col-lg-6 col-lg-offset-3"> <a href="list.php" class="form-control btn btn-success btn-block">list of properties</a> <br> </div> </div> <div class="row"> <div class="col-lg-2"></div> <div class="col-lg-4"> <input type="text" class="form-control btn-block" name="name" placeholder="property name"> <input type="text" class="form-control btn-block" name="owner" placeholder="owner name"> <input type="tel" class="form-control btn-block" name="tel" placeholder="owner telephone number"> <select class=" btn-block form-control" name="type" required> <option value='...'>...</option> </select> <select class=" btn-block form-control" name="location" required> <option value='...'>...</option> . </select> <input type="text" class="form-control btn-block" name="address" placeholder="address"> <input type="number" name="bed" class=" btn-block form-control" placeholder="bedroom" min="0"> </div> <div class="col-lg-4"> <input type="number" name="price" class=" btn-block form-control" placeholder="price (tl)" step="25" min="200"> <lable class="wtxt"><h5><b>property thumbnail image</b></h5></lable> <input type="file" class="form-control btn-block" name="pic" accept="image/*"> <textarea class="form-control btn-block" name="desc" rows="6" required></textarea> <div class="checkbox"> <label> <input type="checkbox" name="agree" value="yes"> agree terms & conditions </label> </div> </div> <div class="col-lg-2"></div> </div> <div class="row"> <div class="col-lg-8 col-lg-offset-2"> <input type="submit" class="form-control btn btn-warning btn-block" name="sendprop" value="submit"> </div> </div> <br><br> </div> </div> </form> <?php newproperty(); ?> what have tried , still not work are: 1. drop table , make new 1 2. change name of table 3. change insert into... values insert into.. set... 4. ....
please me can.
handle error condition, e.g.
if($run){ // whatever } else { echo "<script>alert('sql error: " . htmlspecialchars(mysqli_error($link)) . "');</script>" } as figuring out why statement isn't working, debugging, emit sql text , test in different client.
you're calling mysqli_real_escape_string function on values, not on others. so, sql insert statement still vulnerable sql injection.
a better pattern use prepared statement bind placeholders. it's not hard.
Comments
Post a Comment