signup page error

[amcf1992]

<?php
include("dbsettings.php"); ?>
<?php
// Connect to server and select database.
mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB");

// Get values from form 
$charName=$_POST['charName'];
$charRace=$_POST['charRace'];
$charClass=$_POST['charClass'];
$charLvl=$_POST['charLvl'];
$prof1=$_POST['prof1'];
$prof2=$_POST['prof2'];
$email=$_POST['email'];
$password=$_POST['password'];

echo "$charName,
$charRace,
$charClass,
$charLvl,
$prof1,
$prof2,
$email,
$password";

// Insert data into mysql 
$sql="INSERT INTO $tbl_name(id, charName, charRace, charClass, charLvl, charprofession1, charprofession2, email, password)
VALUES('','$charName', '$charRace', '$email', '$charName', '$charRace', '$charClass','$charLvl', '$prof1', '$prof2', '$email', '$password')";
$result=mysql_query($sql);

// if successfully insert data into database, displays message "Successful". 
if($result){
echo "Successful";
echo "<BR>";
echo "<a href='index.php'>Back to main page</a>";
}

else {
echo "There was a problem with the database. We'll fix this as soon as possible.";
}

// close connection 
mysql_close();
?>

[mvaz]

First of all, you MUST sanitise all data received from a form.

Secondly, I do not see a variable set for $tble_name.

[Matthew1980]

Welcome to WebmasterWorld amcf1992!

>>Secondly, I do not see a variable set for $tble_name.

I would make an educated guess that $tble_name is in the include file :)

mvaz is completely right though, also $_POST/$_GET data needs to be sanitised; NEVER trust user submitted data.

The issue with this code is that there is no error handling in place, no logic to control what happens upon erroneous form submission - and my favourite one ;) the mysql_close function is completely redundant here, the connection is naturally close upon completion of the execution of the script.

Other than that, the OP doesn't actually state what error's are actually stopping this from working.

Start with Error_reporting(E_ALL); at the top of the script, this will highlight anything the PHP would class as problematic.

Have fun.

Cheers,
MRb

[rocknbil]

1. What is the error?

2. This logic is a little faulty:

result=mysql_query($sql);
if($result){
//
}
else {
//error
}

Better would be

mysql_query($sql) or die("There was a problem with the database. We'll fix this as soon as possible.");
// if insert fails, you'll never get to this point.
echo "Successful";
echo "<BR>";
echo "<a href='index.php'>Back to main page</a>";

Additionally for testing - don't do this live - you can see exactly what mysql tells you the error is.

mysql_query($sql) or die("There was a problem with the database. We'll fix this as soon as possible. " . mysql_error());

3. Looking at your statement - count your fields and values. The error will be "column count doesn't match field count at row 1."

"INSERT INTO $tbl_name(id, charName, charRace, charClass, charLvl, charprofession1, charprofession2, email, password) <-- 9 (nine)
VALUES('','$charName', '$charRace', '$email', '$charName', '$charRace', '$charClass','$charLvl', '$prof1', '$prof2', '$email', '$password')"; <-- 12 (twelve)

Second, they are all out of order:
id, charName, charRace, charClass,
'','$charName', '$charRace', '$email', <-- puts email in char class

Last, you don't need to insert id if it's auto_increment.

(charName, charRace,...
VALUES('$charName', '$charRace',