Help me find a bug! The cell is created in the database, but the values ​​are not recorded. How to fix?

<? if ($_COOKIE["TestCookie"] == NULL) { $value = 'что-то где-то'; setcookie("TestCookie", $value); ?> <div id="footer"> <form method="post" action=""> <input type="text" name="name"> <input type="text" name="price"> <input type="submit"> </form> </div> <? $db = mysql_connect("localhost", "root", ""); $ttt = mysql_select_db("testi3", $db); $q = mysql_query("SELECT * FROM trans"); $strSQL = "INSERT INTO trans(name, price) VALUES(name, price)"; mysql_query($strSQL) or die(mysql_error()); } else { echo "Вы можете добавить еще одно сообщение только завтра!"; } ?>

Update

If you write

 $strSQL = "INSERT INTO trans(name, price) VALUES({'$name'}, {'$price'})";

Gives an error message:

You have an error in your SQL syntax; check the syntax to use mySQL server, {''}) 'at line 1 or I misunderstand it?

  • @ mkrichet1, If ​​you are given an exhaustive answer, mark it as correct (click on the check mark next to the selected answer). - Nicolas Chabanovsky ♦

3 answers 3

Solution to your problem

 $_POST = array_map('mysql_real_escape_string', $_POST); $strSQL = "INSERT INTO trans (name, price) VALUES($_POST['name'], $_POST['price'])";
  • You have an error in your SQL syntax; If you’re on the right line, you’ll find out what you want to use. ”At line 1 ... $ q = mysql_query (" SELECT * FROM trans "); $ _POST = array_map ('mysql_real_escape_string', $ _POST); $ strSQL = "INSERT INTO trans (name, price) VALUES (". $ _ POST ['name']. ",". $ _ POST ['price']. ")"; mysql_query ($ strSQL) or die (mysql_error ()); ... - mkrichet 2:49
  • @ mkrichet1 corrected, try. :) - Bastiane
  • Parse error: syntax error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING in Z: \ home \ intim.ua \ www \ add-content.php
 $query = sprintf('INSERT INTO trans (name, price) VALUES (\'%s\', \'%s\')', $name, $price);

Update

Because your query is written to $ query, and $ strSQL is sent for execution. My comment does not bring anything new, except the readability of the code.

  • @Etki I would not think of. %) - Bastiane 2:42
  • So it does not add to the database at all ... $ q = mysql_query ("SELECT * FROM trans"); $ query = sprintf ('INSERT INTO trans (name, price) VALUES (\'% s \ ', \'% s \ ')', $ name, $ price); mysql_query ($ strSQL) or die (mysql_error ()); } ... - mkrichet

Values ​​from the form are transferred by the post method, but in the code I did not see where you get the variables from the global $_POST array to write them to the database. The $strSQL=..... should $strSQL=..... $name and $price variables.

Update

 $strSQL = 'INSERT INTO trans(name,price) VALUES("'.$name.'","'.$price.'")';

Only the variables $name and $price still need to be defined.