how can I insert multiple datas into sql table using php and html form?

[yuki007]

I need to know how to add many datas into a table using html form and the php query
for example, i want to do like this

<form action="addsong.php" method="post">
song1: <input type="text" name="song" />
song2: <input type="text" name="song" />
song3: <input type="text" name="song" />
song4: <input type="text" name="song" />
<input type="submit" value="submit" />
</form>

I'm extremely intersted in the query
any help wd be apreciated !!.
thanks in advance

[Markus]

Show what you have attempted.
The info you gave us alone is not nearly enough for us to help you.

[yuki007]

well, I wanted to add 5 songs or more in the mean time instead of adding one song each time, what is the function that can do that? or can i do it with a simple query ?
now that's my simple script

[PHP]<?php
mysql_connect("localhost", "root", "123456");
mysql_select_db("test");
?>
<?php
$query = "INSERT INTO songs VALUES ('', '$name')";
if ( $song = mysql_query($query) ) {
$message = "Success";
} else {
$message = "Failure";
}
?>
<form action="addsong.php" method="post">
song1: <input type="text" value="" name="name" /><br />
song2: <input type="text" value="" name="name" /><br />
song3: <input type="text" value="" name="name" /><br />
<input type="submit" />
</form>
<?php echo $message; ?>[/PHP]

[Dormilich]

some note on security:
if possible avoid accessing the database with the "root" user, a standard account will do fine.
if you use "INSERT INTO table_name (col_name) VALUE (value);" you get rid of passing the empty string (see MySQL manual)
check/secure your input values (e.g. with mysql_real_escape_string(), for more info search google)
don't rely on register_globals=on, rather use the $_POST or $_GET superglobals.
it could be useful to cache all the form values in an array.
another (shorter) way to check mysql execution is "mysql_query() or die(mysql_error()); // basicly like that"

regards

[yuki007]

thanks, but i ddnt get what u want to say, please
will u just repeat my script with the additional needs to do that ??
I'll be so thankful :)

[Markus]

thanks, but i ddnt get what u want to say, please
will u just repeat my script with the additional needs to do that ??
I'll be so thankful :)

Attempt it yourself and we can then correct you on your errors.

[Dormilich]

I can explain what I meant.

1. the user called "root" is something like a super admin, he's allowed to do everything. e.g. delete the database, change settings (like passwords), creating accounts, typical admin stuff. if someone exploits your script he can get access to your DB and is free to do with it as he likes.

2. currently you're passing 2 values ('' (empty string) and $name). there is normally no reason to pass an empty string to db. if you change your sql statement like mentioned (there is a complete description in the MySQL manual) your code gets better readable.

3. for security reason (see point 1) there are functions that allow you to block most sql exploits, to properly escape the passed variables is one of the most important.
a cracker may insert not his name but malicious sql code (topic: sql code injection) and may so gain access to your db (and if he does that as root, say good-bye to your data)

4. "globals are evil" (more on google) global variables are a potential security issue to your code. with register_globals=on every value passed by get and/or post is translated to a variable and may so set initial values that may be harmful to you. you can add a get variable simply by manually adding &key=value to the query url. additional post variables are made similarly.
instead of using $name use $name = $_POST['name'];

5. "mysql_query() or die();" reduces unnecessary code (you may call other functions than die(), e.g. "throw new Exception()", trigger_error(), ...) usually if your query fails you need to know why and this kind of functions help you fixing it.

6. how to put that into code is described in the references (see links) or in tutorials

regards

[yuki007]

thanks guys you're really helpful, i will try that..