updated email.php

[mlawday]

Added mysql code to the form. However, the information entered in the form is not being saved in the database. I have tried changing my code, but with no success. The code connects to the database but does not store the user information

[trevynmeyer]

echo out the $query value;

Paste that SQL into phpMyAdmin to see if your SQL is accepted or not.

This is a scenario you can learn about SQL injection.

If my email comment was DROP * tables; or domethign, it could in fact make your SQL run something malicious.

There are functions in PHP like htmlspcecialchars() or addslashes() that can be run to proect the content from being interpreted as SQL commands.

Paste your SQL statement and response here.

[mlawday]

Oh ok that makes sense. I know about the mysqli_real_escape_string. Would it be appropriate to put that in the VALUES code to prevent malicious attacks?

Here is the message it gave back to me when I put the SQL code in: #1327 - Undeclared variable: users

[trevynmeyer]

Paste me the entire SQL command.

[mlawday]

SELECT * FROM users WHERE 1INSERT INTO users (name, email, subject, message) VALUES ('mark', '', 'mark', 'mark');

[mlawday]

whoops. Just realized it never deleted the previous code. It took the code INSERT INTO users (name, email, subject, message) VALUES ('mark', '', 'mark', 'mark');

[trevynmeyer]

do you have a table created called users?

users is a special word for SQL

try users

the back ticks make it know its not a special mysql variable.

The other thing may be that you are connected to mysql, but not the specific database.

[mlawday]

removed the back ticks, still didn't take. I have a table called users. I created a new user to the database as well and that is what I am using in my code. I can log in with that username and password and mysql connects just fine. I even tried deleting the database and creating a new one.

[trevynmeyer]

hmm, lets do a screnshare on hangout tonight and get this figuredout. Give me FTP access to your new hosts? or cpanel access. Email it to me. I got to run to some meetings but we will chase this down.

Maybe make a new script to test connecting to mysql, selecting a database, and inserting a row into a table.

Just to seperate a working example from your script.