php - inserting info into a database

[comp_guy]

hey guys, can anyone see where im going wrong in my code below? i am
making a registration form on a webpage before using php to send the
input data into a mySQL database. first off is the code for the
registration form:
<form method = "POST" action="display .php"
onSubmit="retur nverifyform(thi s)">

<h1> Please fill in all fields below to register: </h1> Title:

<select name = "title">
<option selected>Please select..
<option>Mr
<option>Mrs
<option>Miss
</select><br>

<br>First name: <input type ="text" name = "first">
<font color = "black"></font><br>

<br>Last name: <input type = "text" name = "last">
<font color="black"></font><br>

<br>Age:
<select name = "age">
<option selected>Please select..
<option>25
<option>26
<option>27
<option>28
<option>29
<option>30
<option>31
<option>other
</select><br>

<br>Subject:
<select name ="subject">
<option selected>Please select..
<option>Compute r Science
<option>Scien ce
<option>Engli sh
<option>Maths
<option>Archite cture
<option>Busines s
<option>Dentist ry
<option>Earth , Ocean and Planetary Science
<option>Enginee ring
<option>Europea n Studies
<option>Histo ry and Archaeology
<option>Journal ism, Media and Cultural Studies
<option>Law
<option>Medicin e
<option>Music
<option>Religio us and Theological Studies
<option>Welsh
<option>Other
</select><br>

<br>Initial Year of Study:
<select name = "year">
<option selected>Please select..
<option>1990
<option>1991
<option>1992
<option>1993
<option>1994
<option>1995
<option>1996
<option>1997
<option>1998
<option>1999
<option>other
</select><br>

<br>Email Address: <input type = "text" name = "email">
<font color="black"></font><br>

<br>User Name: <input type = "text" name = "user_name" >
<font color="black"></font><br>

<br>Password: <input type = "password" name = "password">
<font color="black"></font><br>

<br><input type="submit" name = "Send" value = "Send">

</form>

next off is the code using php:
<?php

$connection =
mysql_connect(" sentinel.cs.cf. ac.uk","scm5sjc ","my_password_ here");
mysql_select_db ("sjcdb",$conne ction)or die("failed!");

$title=$_POST['title'];
$first=$_POST['first'];
$last=$_POST['last'];
$age=$_POST['age'];
$subject=$_POST['subject'];
$year=$_POST['year'];
$email=$_POST['email'];
$user_name=$_PO ST['user_name'];
$password=$_POS T['password'];

mysql_query("IN SERT INTO info VALUES ('',
'$title','$last ','$age',$subje ct','$year','$e mail','$user_na me','$password' )",$connection) ;
mysql_close(con nection);

?>

anyone know where im going wrong??
cheers

[fiziwig]

Did you account for every field in the table? There must be as many
values as their are fields or the query will fail.

[bobzimuta]

Extract the query into a string (i.e. $query = "..."), and replace
mysql_query() with
the following:

if( !mysql_query( $query, $connection ) )
{
exit( mysql_error( $connection ) . "<br>Query: <br><pre>" . $query .
"</pre>" );
}

You can wrap all your query calls in a function, as it enables basic
debugging any time a query might fail
function my_query( $query, $connection, $DEBUG = 0 )
{
$query_worked = mysql_query....
if( !$query_worked && $DEBUG )
{
// do the exit and output here, or just output and return
$query_worked
}
else
{
return $query_worked;
}
}

}

[Iván Sánchez Ortega]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

comp_guy wrote:

anyone know where im going wrong??

You're wrong in not using a "value" attribute in the <option> tags, and
you're wrong in trusting the posted values without checking or escaping
them first.

- --
- ----------------------------------
Iván Sánchez Ortega -i-punto-sanchez--arroba-mirame-punto-net

http://acm.asoc.fi.upm.es/~mr/ ; http://acm.asoc.fi.upm.es/~ivan/
MSN:i_********* *************** *@hotmail.com
Jabber:iv****** ***@jabber.org ; iv*********@kde talk.net
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFEIvpe3jc Q2mg3Pc8RAt0NAJ 9zCcH4zABN2Saqp JaXNqyl7ES5xwCf ZuXQ
JvMhkfm1TsIDwH3 l+mWYCp4=
=F2QF
-----END PGP SIGNATURE-----

[william.clarke]

For debugging purposes, storing the query in a variable (which you will
use as bobzimuta said eg. mysql_query( $query, $connection ))and
echoing it to the screen will often show up sql syntax errors.