How Do I Prevent Blank Data from being Inserted into a MySQL Table?

Question

Also malicious inserts

I've seen this question asked but none of the responses worked for me (or rather I was too stupid to make them work). I think I need personalized help. Every time I refresh my php page it inserts blank data. How do I prevent blank and/or malicious data from being inserted.

This is my code:

 <?php $con = mysql_connect("localhost","user","pass") or die ("Couldn't connect!"); if (!$con) { die('Could not connect: ' . mysql_error()); } mysql_select_db("streams") or die ("Couldn't find db"); $sql="INSERT INTO streams (streamname) VALUES ('$_POST[streamname]')"; if (!mysql_query($sql,$con)) { die('Error: ' . mysql_error()); } echo "1 record added"; mysql_close($con) ?> <form action="submit.php" method="POST"> Stream Name: <input type="text" name="streamname" id="streamname" /><br /> <input type="submit" name="submit" value="Stream" /> </form>

you didnt't validate $_POST[streamname]. By "blank data" you mean '' or NULL ? — Esselans
– Esselans, Commented Jan 10, 2012 at 0:46

SeanCannon · Accepted Answer · 2012-01-10 00:46:55Z

5

Wrap it with some defensive logic:

if(!empty($_POST['streamname'])) { // Your code here }

answered Jan 10, 2012 at 0:46

SeanCannon

78.1k17 gold badges126 silver badges145 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

dqhendricks Over a year ago

also, if someone enters an empty value, you should give them a warning message stating that it is a required field so they understand why the form will not submit.

Colton Allen Over a year ago

That wraps the entirety of the php from the mysql open to close?

DaveE · Accepted Answer · 2012-01-10 00:45:18Z

Try checking if POST params are set :

 <?php if($_POST) { $con = mysql_connect("localhost","user","pass") or die ("Couldn't connect!"); if (!$con) { die('Could not connect: ' . mysql_error()); } mysql_select_db("streams") or die ("Couldn't find db"); $sql="INSERT INTO streams (streamname) VALUES ('$_POST[streamname]')"; if (!mysql_query($sql,$con)) { die('Error: ' . mysql_error()); } echo "1 record added"; mysql_close($con); } ?> <form action="submit.php" method="POST"> Stream Name: <input type="text" name="streamname" id="streamname" /><br /> <input type="submit" name="submit" value="Stream" /> </form>

just because the post params are set, doesn't mean they won't be blank.

Alex M · Accepted Answer · 2012-01-10 00:46:09Z

0

You should be escaping the input.

$sql='INSERT INTO streams (streamname) VALUES ("'.mysql_real_escape_string($_POST[streamname]).'")';

answered Jan 10, 2012 at 0:46

Alex M

3,5232 gold badges22 silver badges23 bronze badges

7 Comments

dqhendricks Over a year ago

while important, this is a comment rather than an answer to the question.

Alex M Over a year ago

I think it's probably a fix since the array reference is used properly in the insert in this statement.

Colton Allen Over a year ago

@amccausl What does an escape string do?

Alex M Over a year ago

It will remove the potential for a sql injection attach

Colton Allen Over a year ago

@amccausl I edited my code with what you gave me. But it seems to have messed up some of my other code. Now when I make a call to the database instead of saying something like: hi my name is "data". it says hi my name is "mysql escape (data)".

|

Collectives™ on Stack Overflow

How Do I Prevent Blank Data from being Inserted into a MySQL Table?

3 Answers 3

2 Comments

1 Comment

7 Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

1 Comment

7 Comments

Linked

Related