PHP: Inserting Values from the Form into MySQL

by

The following code just declares a string variable that contains a MySQL query:

$sql = "INSERT INTO users (username, password, email)
    VALUES ('".$_POST["username"]."','".$_POST["password"]."','".$_POST["email"]."')";

It does not execute the query. In order to do that you need to use some functions but let me explain something else first.

NEVER TRUST USER INPUT: You should never append user input (such as form input from $_GET or $_POST) directly to your query. Someone can carefully manipulate the input in such a way so that it can cause great damage to your database. That’s called SQL Injection. You can read more about it here

To protect your script from such an attack you must use Prepared Statements. More on prepared statements here

Include prepared statements to your code like this:

$sql = "INSERT INTO users (username, password, email)
    VALUES (?,?,?)";

Notice how the ? are used as placeholders for the values. Next you should prepare the statement using mysqli_prepare:

$stmt = $mysqli->prepare($sql);

Then start binding the input variables to the prepared statement:

$stmt->bind_param("sss", $_POST['username'], $_POST['email'], $_POST['password']);

And finally execute the prepared statements. (This is where the actual insertion takes place)

$stmt->execute();

NOTE Although not part of the question, I strongly advice you to never store passwords in clear text. Instead you should use password_hash to store a hash of the password

More Related Contents:

  1. Parse error: syntax error, unexpected T_STRING in C:\wamp\www\b_php\project\login_save.php on line 14 [closed]
  2. Php charset information [duplicate]
  3. Save the data into a database and return another value from database using PHP
  4. Math Symbol From Mysql To HTML? [closed]
  5. Create hyperlink from html table row to open record on a new page
  6. Is the following code valid? [closed]
  7. How to insert images into a database using PHP [closed]
  8. How to retrieve images from MySQL database and display in an html tag
  9. Preserve Line Breaks From TextArea
  10. How to upload images into MySQL database using PHP code
  11. Fetching data from MySQL database to HTML dropdown list
  12. HTML – Change\Update page contents without refreshing\reloading the page
  13. Delete multiple rows by selecting checkboxes using PHP
  14. “slash before every quote” problem [duplicate]
  15. mysql_fetch_array() expects parameter 1 to be resource problem [duplicate]
  16. How to add a delete button to a PHP form that will delete a row from a MySQL table
  17. Dynamic table in HTML using MySQL and php
  18. mysqli_query() expects at least 2 parameters, 1 given in? [duplicate]
  19. display data from SQL database into php/ html table [closed]
  20. Echo menu tree with recursive function
  21. How to display an BLOB image stored in MySql database?
  22. Sending HTML Code Through JSON
  23. Javascript function post and call php script
  24. PHP – Secure member-only pages with a login system
  25. onbeforeprint() and onafterprint() equivalent for non IE browsers
  26. Creating dynamic tables in HTML using MySQL and PHP
  27. Create table with PHP and populate from MySQL
  28. mysql_fetch_array skipping first row
  29. Displaying BLOB image from Mysql database into dynamic div in html
  30. MySQL PHP – SELECT WHERE id = array()? [duplicate]

Leave a Comment