PHP SQL Injection Example,
February 16, 2009 at 8:16 PM
I did your code in your example PHP SQL Injection, why do I always get SQL error:Unknown column for surname? here's the code. <html> <title>Table for Students</title>
<body "> <body bgcolor= #6A5ACD>
<form method="post" action="insert.php"
style="border: 4px solid #000000; width :260px; margin-top: 50px;margin-left: 70px; padding:20px 20px 20px 20px; background-color:#DDA0DD ;"> <table cellpadding="5">
<div style="border: 4px solid #000000; width :800px; margin-top: 50px;margin-left: 70px; padding:20px 20px 20px 20px ; background-color: #DDA0DD;">
<?php
$connection = mysql_connect('localhost','root','') or die("Could not connect: ".mysql_error()); $connection1 = mysql_connect('localhost','root','') or die("Could not connect: ".mysql_error());
mysql_select_db('pvdorm',$connection) or die("Error in selecting the database:".mysql_error());
if (isset($_POST['name'])) { $Firstname=$_POST["name"]; $Lastname=$_POST["lname"]; $Nickname=$_POST["nname"]; $Birth=$_POST["bh"];
$sql="insert into students(firstname,lastname,nickname,birth) values('".$Firstname."',".$Lastname.",".$Nickname.",".$Birth.")";
mysql_query($sql,$connection) or exit("Sql Error:".mysql_error()); mysql_close($connection);
}
$sql="Select *from students";
$sql_result=mysql_query($sql,$connection1) or exit("Sql Error".mysql_error());