473,387 Members | 1,863 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,387 software developers and data experts.

FORM METHOD=post ACTION='*.php' only sends empty spaces to mysql ?

Hi,
i'am running a debian sarge with the delivered apache2 mysql and php4.
The file "mitarbeiter_eingabe.php" gets the data over a html <FORM>
and send it to
"mysql_mitarbeiter_daten_hinzufuegen.php" to write it in an mysql
database.
These already worked on php3 and mysql-3 and now on php4 and mysql4 it
doesn't work. I can't found any changes between php3 and php4, mysql3
and mysql4 that explained the fact that only empty spaces are given to
the mysql database.
mitarbeiter_eingabe.php -> mysql_mitarbeiter_daten_hinzufuegen.php ->
mysql-database

if i replace a %s in mysql_mitarbeiter_daten_hinzufuegen.php with a
real value like "Armin" he write it in the mysql-database ?

What did i miss or didn't see ?
Greetings
Armin Irger
----------
mitarbeiter_eingabe.php :
----------
<? // mitarbeiter_eingabe.php
require("globals.php");
require("common.php");
GenerateHTMLHeader('Enter a new employee');
echo "<FORM METHOD=post
ACTION='mysql_mitarbeiter_daten_hinzufuegen.php'>< PRE>";
printf ("Title: <INPUT TYPE=text SIZE=35 NAME=titel
VALUE=\"%s\">
<BR>\n", ($formValues) ? $formValues["titel"] : "");
printf ("First name: <INPUT TYPE=text SIZE=35 NAME=vorname
VALUE=\"%s\">
<BR>\n", ($formValues) ? $formValues["vorname"] : "");
printf ("Last name: <INPUT TYPE=text SIZE=35 NAME=nachname
VALUE=\"%s
\">
<BR>\n", ($formValues) ? $formValues["nachname"] : "");
printf ("eMail: <INPUT TYPE=text SIZE=35 NAME=email
VALUE=\"%s\">
<BR>\n", ($formValues) ? $formValues["email"] : "");
printf ("Phone (at work): <INPUT TYPE=text SIZE=35
NAME=telefon_dienstlich
VALUE=\"%s\">
<BR>\n", ($formValues) ? $formValues["telefon_dienstlich"] :
"");
printf ("Initials: <INPUT TYPE=text SIZE=35 NAME=kürzel
VALUE=\"%s\"

<BR>\n", ($formValues) ? $formValues["kürzel"] : "");
echo "<BR><BR>";
echo "<INPUT TYPE=submit VALUE='Save'>";
echo "</PRE></FORM>";

generateHTMLFooter();


----------
mysql_mitarbeiter_daten_hinzufuegen.php :
----------

<? // mysql_mitarbeiter_daten_hinzufuegen.php
require("globals.php");
require("common.php");

$sql_query = "INSERT into $table_mit(TITEL, VORNAME, NACHNAME,
EMAIL, TELEFON_DIENSTLICH, KUERZEL)
values ('%s','%s','%s','%s','%s','%s')";
// Serververbindung testen

if (!($link=mysql_pconnect($host,$user,$passwd))) {
DisplayErrMsg(sprintf("Fehler bei Verbindungsaufbau zu Server
%s, unter Benutzer %s",$host,$user));
exit();
}

// Datenbankverbindung testen
if (!mysql_select_db($database, $link)) {
DisplayErrMsg(sprintf("Fehler bei Auswahl der Datenbank %s",
$database));
DisplayErrMsg(sprintf("Fehler: %d %s",mysql_errno($link),
mysql_error($link)));
exit();
}

// SQL Query Ausführen
if (!mysql_query(sprintf($sql_query,$titel,$vorname,$ nachname,
$email,$telefon_dienstlich,$kürzel),
$link)) {
DisplayErrMsg(sprintf("Fehler beim Ausführen der SQL-Abfrage %s",
$sql_query));
DisplayErrMsg(sprintf("Fehler: %d %s",mysql_errno($link),
mysql_error($link)));
exit();
}

GenerateHTMLHeader('Data saved sucessfully!');
generateHTMLFooter();
?>

----------
mysql.log
----------

050222 17:13:19 21 Connect active@localhost on
21 Init DB ACTIVE
21 Query INSERT into MITARBEITER(TITEL,
VORNAME, NACHNAME,
EMAIL, TELEFON_DIENSTLICH, KUERZEL)
values ('','','','','','')
Jul 17 '05 #1
3 6581
ir*********@web.de (Armin Irger) wrote in
news:e9**************************@posting.google.c om:
Hi,
i'am running a debian sarge with the delivered apache2 mysql and php4.
The file "mitarbeiter_eingabe.php" gets the data over a html <FORM>
and send it to
"mysql_mitarbeiter_daten_hinzufuegen.php" to write it in an mysql
database.
These already worked on php3 and mysql-3 and now on php4 and mysql4 it
doesn't work. I can't found any changes between php3 and php4, mysql3
and mysql4 that explained the fact that only empty spaces are given to
the mysql database.
mitarbeiter_eingabe.php -> mysql_mitarbeiter_daten_hinzufuegen.php ->
mysql-database

if i replace a %s in mysql_mitarbeiter_daten_hinzufuegen.php with a
real value like "Armin" he write it in the mysql-database ?

What did i miss or didn't see ?
Greetings
Armin Irger

<snip>

Your form variables are not properly set in the script that writes to the
database.

Check the register_globals setting in php.ini (should be ON for the way
you're doing it here) or get the variables from the $_POST system
variable.
Example:

Change:

if (!mysql_query(sprintf($sql_query,$titel,$vorname,$ nachname,
$email,$telefon_dienstlich,$kürzel),
$link)) {

To:

if( !mysql_query(sprintf($sql_query,
$_POST['titel'],
$_POST['vorname'] .... etc...
By the way, these values should be escaped here (see mysql_escape_string
function ) depending on the magic_quotes_gpc config setting.
Jul 17 '05 #2
.oO(Armin Irger)
i'am running a debian sarge with the delivered apache2 mysql and php4.
The file "mitarbeiter_eingabe.php" gets the data over a html <FORM>
and send it to
"mysql_mitarbeiter_daten_hinzufuegen.php" to write it in an mysql
database.
These already worked on php3 and mysql-3 and now on php4 and mysql4 it
doesn't work.


Make sure error_reporting is set to E_ALL in your php.ini, you should
receive some notices. It's most likely a register_globals issue, the
default setting changed to Off in recent PHP versions for security
reasons. Use the superglobal array $_POST (or $_GET) to access the
submitted values, so instead of $vorname use $_POST['vorname'].

11.20. Warum funktionieren meine Formulare nicht?
http://www.php-faq.de/q/q-formular-r...r-globals.html

Some other things:

* Use <?php instead of the short open tag <?, it's more portable.
* Consider to use label and fieldset elements to improve your form's
usability.
* HTML allows single quotes around attribute values, this avoids ugly
escaping of double quotes inside a double quoted string.
* Do a search on Google for 'SQL Injection', your code is vulnerable.

16.18. Wie kann ich bösartigen Code in SQL-Abfragen unterbinden?
http://www.php-faq.de/q/q-sql-injection.html

Micha
Jul 17 '05 #3
Michael Fesser <ne*****@gmx.net> wrote in message news:<ii********************************@4ax.com>. ..
.oO(Armin Irger)
i'am running a debian sarge with the delivered apache2 mysql and php4.
The file "mitarbeiter_eingabe.php" gets the data over a html <FORM>
and send it to
"mysql_mitarbeiter_daten_hinzufuegen.php" to write it in an mysql
database.
These already worked on php3 and mysql-3 and now on php4 and mysql4 it
doesn't work.


Make sure error_reporting is set to E_ALL in your php.ini, you should
receive some notices. It's most likely a register_globals issue, the
default setting changed to Off in recent PHP versions for security
reasons. Use the superglobal array $_POST (or $_GET) to access the
submitted values, so instead of $vorname use $_POST['vorname'].

11.20. Warum funktionieren meine Formulare nicht?
http://www.php-faq.de/q/q-formular-r...r-globals.html

Some other things:

* Use <?php instead of the short open tag <?, it's more portable.
* Consider to use label and fieldset elements to improve your form's
usability.
* HTML allows single quotes around attribute values, this avoids ugly
escaping of double quotes inside a double quoted string.
* Do a search on Google for 'SQL Injection', your code is vulnerable.

16.18. Wie kann ich bösartigen Code in SQL-Abfragen unterbinden?
http://www.php-faq.de/q/q-sql-injection.html

Micha


Thanks.
It works.

Greetings
Armin Irger
Jul 17 '05 #4

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

5
by: Google Mike | last post by:
I have RH9 Linux with the versions of Apache and PHP that came with it. The PHP is version 4.2.2 on the CD, I believe. Apache, I think, is version 2.0. I found I can do some regular PHP stuff...
9
by: Dave Martin | last post by:
I've successfully used CURL to maneuver around and through sites but a new site I've been trying to work with has got me stumped. To retrieve the data I'm trying to get a login is required. If...
5
by: Phil Powell | last post by:
I cannot fathom this one.. for some cracked reason, one of my forms is totally OK and the other is apparently nonexistent according to both HTML and Javascript. The second form never submits...
4
by: Al Cadalzo | last post by:
I'm trying to simulate a form post (i.e. Method="POST"). The FORM POST I'm trying to simulate is similar to this: <FORM NAME=SearchForm METHOD=POST ACTION=Search> <SELECT name="criteriaA" >...
8
by: Adam | last post by:
Hey, I'm using JS to submit a form with image submit buttons, using the following code... (Page is here... http://www.cards2do.co.uk/addcard.php?card_id=292 ) ...
4
by: Bosconian | last post by:
I have created a form tool page that consists of several dropdowns which allows a user to drill down and select a desired document for viewing in an external window. I need to post the form data to...
1
by: Muchach | last post by:
Hello, Ok so what I've got going on is a form that is populated by pulling info from database then using php do{} to create elements in form. I have a text box in each table row for the user to...
3
by: kostas88 | last post by:
Hello, I am trying to submit a form that has two other forms inside it. It works fine in Firefox but not in IE6. For some reason it seems that document.getElementById('submitbtn').click(); is not...
1
omerbutt
by: omerbutt | last post by:
HI I am WORKING ON A PROJECT IN WHICH I HAVE TO CREATE SOME INPUT FIELDS by selecting the number of inputs from a select menu the problem is that when i post the form the fields inside the div are...
0
by: taylorcarr | last post by:
A Canon printer is a smart device known for being advanced, efficient, and reliable. It is designed for home, office, and hybrid workspace use and can also be used for a variety of purposes. However,...
0
by: Charles Arthur | last post by:
How do i turn on java script on a villaon, callus and itel keypad mobile phone
0
by: aa123db | last post by:
Variable and constants Use var or let for variables and const fror constants. Var foo ='bar'; Let foo ='bar';const baz ='bar'; Functions function $name$ ($parameters$) { } ...
0
by: ryjfgjl | last post by:
If we have dozens or hundreds of excel to import into the database, if we use the excel import function provided by database editors such as navicat, it will be extremely tedious and time-consuming...
0
by: ryjfgjl | last post by:
In our work, we often receive Excel tables with data in the same format. If we want to analyze these data, it can be difficult to analyze them because the data is spread across multiple Excel files...
0
marktang
by: marktang | last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However,...
0
by: Hystou | last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can...
0
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers,...
0
jinu1996
by: jinu1996 | last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.