Warning: Cannot modify header information - headers already sent by

[CalvinSmith]

Hi Everyone,

I've searched and searched and tried and tried but to no avail. Below is the EXACT script I am trying to run - with no white spaces (that I can see). I am trying to redirect this PHP script after it runs. It is running independently and is not part of an HTML page. The script is in the PHP file as I'm pasting it below but I STILL get the error: Warning: Cannot modify header information - headers already sent by (output started at /home/**/public_html/insert.php:1) in /home/**/public_html/insert.php on line 18.
Lone 18 is the Header line.
Without the header line the script works perfectly I just need to try and redirect it now.
Please help

<?php
$con = mysql_connect("*","*","*");
if (!$con)
{
die('Could not connect: ' . mysql_error());
}
mysql_select_db("**", $con);
$sql="INSERT INTO contactdetails (Name,Surname,Number,Email,MovingFrom,MovingTo,Date)
VALUES ('$_POST[Name]','$_POST[Surname]','$_POST[Number]','$_POST[Email]','$_POST[MovingFrom]','$_POST[MovingTo]','$_POST[Date]')";
$sql="INSERT INTO destination (CurrentPremises,CurrentFloor,DestinationPremises,DestinationFloor,WrapEverything,Unpack,Hangerpack,SendMaterials,InsureEverything) 
VALUES ('$_POST[CurrentPremises]','$_POST[CurrentFloor]','$_POST[DestinationPremises]','$_POST[CurrentFloor]','$_POST[WrapEverything]','$_POST[Unpack]','$_POST[Hangerpack]','$_POST[SendMaterials]','$_POST[InsureEverything]')";
if (!mysql_query($sql,$con))
{
die('Error: ' . mysql_error());
}
mysql_close($con);
ob_start();
header("Location: email.php");
ob_end_flush();
exit;
?>

[Matthew1980]

Hi there CalvinSmith,

Welcome aboard!

Firstly, I cannot stress this enough, never use $_POST or $_GET vars directly into sql queries, as this has the potential to harm your data if a user decides to inject a sql command like DROP. Sanitise the data first using mysql_real_escape_string() around the vars.

Secondly, use error_reporting(E_ALL) as the first command under the opening tag, this will point you to any errors in the script.

Lastly, this, I am not sure why you have this:-

mysql_close($con);
ob_start();
header("Location: email.php");
ob_end_flush();
exit;
?>

Do this instead:-

mysql_close($con);
header("Location: email.php");
?>

I dont think as you need the exit; there unless you have HTML under the closing tag - which I doubt seeing as there is a redirect there;

The two sql queries both have the same var name assigned even though they are two distinctly seperate queries, it would be good practise to get into naming vars relevant to their purpose!

Just noticed as there is only one query actually being sent too, so the last one is the only one actually being sent!

Hope this helps you a little

Good luck!

Cheers,
MRb

[CalvinSmith]

Thank you for your reply Matthew!
Being new at PHP your first line confused me completely.
The only way I know (shown) how to retrieve data from an sql database is with the script above - if you could point me in a new direction i would be grateful to learn. I've started reading the php.net manual but it makes very little sense in application that i have here.
Also im not sure what you mean by only the last query is being sent.
Please confirm the following with me:

mysql_select_db("*****", $con);

<- tells it which database

$sql="INSERT INTO *****(Name,Surname,Number,Email,MovingFrom,MovingTo,Date)

<-Tells it which table to insert to

 VALUES ('$_POST[Name]','$_POST[Surname]','$_POST[Number]','$_POST[Email]','$_POST[MovingFrom]','$_POST[MovingTo]','$_POST[Date]')";,

<-Tells it what data to enter into which field on the table.
And then I basically repeated the same. Into the same database just a different table?
I only put that OBFulsh in because the redirect wasnt working. Even when removed the error remains.

[CalvinSmith]

Downloaded Notepad++ and Changed the Encoding which resolved the redirect issue.

[Matthew1980]

Hi there CalvinSmith,

Right: Clarity ;-p

Take any query, and this is the preferred (safer way) of placing $_POST/$_GET vars into a query:-

$sqlQuery = "SELECT * FROM `TableName` WHERE `YourUser` = '".mysql_real_escape_string(strip_tags($_POST['your_value']))."' ";

Thats an example, but from that you can pretty much see the point I am trying to make there.

strip_tags(); strips html tags from user submitted data (search on php.net)

mysql_real_escape_string(); makes user submitted data safe for use within a sql query, this is the important one!

Your query:-

$sql="INSERT INTO contactdetails (Name,Surname,Number,Email,MovingFrom,MovingTo,Date)
VALUES ('$_POST[Name]','$_POST[Surname]','$_POST[Number]','$_POST[Email]','$_POST[MovingFrom]','$_POST[MovingTo]','$_POST[Date]')";
$sql="INSERT INTO destination (CurrentPremises,CurrentFloor,DestinationPremises,DestinationFloor,WrapEverything,Unpack,Hangerpack,SendMaterials,InsureEverything)
VALUES ('$_POST[CurrentPremises]','$_POST[CurrentFloor]','$_POST[DestinationPremises]','$_POST[CurrentFloor]','$_POST[WrapEverything]','$_POST[Unpack]','$_POST[Hangerpack]','$_POST[SendMaterials]','$_POST[InsureEverything]')";

The bold text highlights the second query, and you only have ONE query being sent:-

if (!mysql_query($sql,$con))

So the last defined $sql will be the one sent to the DB.

I didn't mean to confuse, but all as you need to do is distinguish the queries & then make two if statements to send one, then send the other if the first was successful.

ie:

$sqlOne = "query one to be sent";
$sqlTwo = "query two to be sent";

$sentOne = mysql_query($sqlOne);
if($sentOne))
{
//first sent, now send the next
$sqlTwo = mysql_query($sqlTwo) or die(mysql_error());
}
else{
//throw error, the query wasn't sent
echo "Problem sending query";
exit;
}

Typed on the fly, but hopefully from that you can see what I am trying to get across.

The structure of your queries is fine though ;-p technically they need formatting correctly, but they will work.

Cheers,
MRb