You know that "crazy thing" that many of us say and what Stack is about, right?
- Stack isn't about writing code.
IMHO, the same thing applies to doing rewrites.
About a question/problem with code:
- A question is posted, answer(s)/solution(s) given. (If) it fixed it, great, end of story.
This one's mostly in regards to PHP/MySQL.
We see questions that have obvious syntax errors and answers are submitted that actually "fix" their posted code, but then you see most or all of the good/correct answers being downvoted; why is that?
I know, it's probably hard (if not impossible) for anyone to really answer that and to get to the bottom of it. I have my own views on this, but is an entirely different animal that can't be dealt with.
Take for example, and in regards to some PHP/MySQL related questions:
Why would a perfectly good/correct answer be downvoted?
Possible reasons:
- Because it wasn't rewritten using a (MySQLi) prepared statement?
- Because it was written in MySQLi_ and not rewritten in PDO?
- Because it was rewritten using the PDO API but not as a prepared statement?
- Because it solved the question without using any of the above mentioned?
Take the following Q&A's, where (correct) answers were downvoted. This is only a partial/recent list I've been keeping track of, due to questions being improperly closed and using the wrong duplicate(s):
Edit: The following can only be viewed by 10k+ members, since they voted to delete them. Why? I have no idea.
Edit #2: Consult "Deleted and fetched references edit" below, since the deleted questions are not viewable by members with less than 10k. They too have a right to see them and their voices/votes count just as much as anyone.
- https://stackoverflow.com/questions/42436553/column-count-doesnt-match-value-count-but-there-are-6-values-and-6-columns
- https://stackoverflow.com/questions/42337865/insert-query-not-being-fired
- https://stackoverflow.com/questions/42429767/capture-array-values-from-input-fields-using-php-in-mysqli
- https://stackoverflow.com/questions/18869513/php-insert-into-not-working
Sidenote: I know my PHP/MySQL syntax rather well in order to differentiate between a correct and a wrong answer.
Most or all (technically correct) answers were downvoted and I don't feel that's fair towards those who offered their (free) gracious help.
After all, we're not "paid" for doing this, as rewrites can potentially take a lot of time. If someone wants to rewrite it, great; that's their decision. But downvoting other answers while doing the rewrites seems almost be a case of wanting to take over a tag. It's like being in a relationship where one person believes themselves the only one to be right all of the time.
If the downvoting of perfectly good answers continues and isn't stopped or slowed down, there stands to be (more) members who won't bother helping/contributing anymore, and this I've been told quite a few times by other members (be it asker/answerer) in the distant and the not so distant past; this being a fact, I'm not making this up.
There have been a few really good coders/contributors that I've had the pleasure of knowing. They're either no longer contributing at all and just left, or are no longer contributing to the "php/mysql" sections but elsewhere.
I agree that if a wrong answer was downvoted, it probably deserved it because it was either totally wrong, they missed something important or it didn't answer the question. It's an anonymous vote, which we all know.
Some post a comment under the (wrong) answer, others choose not too; that's their decision and I for one respect it. Many/I don't like it but I "respect" it.
I agree that security is of the utmost importance and they should be "informed" about it; but not by "rewriting" their code nor be downvoted for it.
Some of the question may contain 20, 30+ arrays and doing an entire rewrite with named placeholders, or ?
placeholders would take a fair amount of time to rewrite complete with secure code and many of those who answer only want to correct the OP using the same method the OP is using while providing a warning about SQL injection, prepared statements and plain text and/or deprecated hash methods for passwords. "Teach a man to fish", so to speak.
What if the OP doesn't understand what those mean and how to use them/modify them later on, or don't know how to change their DB connection method, and/or class(es) and method(s)? Many are obviously "learning" how to code, doing it step-by-step / baby steps; we were all "there" at one time, so let's not forget where we came from.
That's where (official) manuals and tutorials come in, right? Well, Stack isn't a "tutorial site", it's a place where we help people fix code, or the occasional ones where they're seeking "guidance" on a complex procedure; the latter are asked by both the newbie and "seasoned" coder alike.
If we/I can help in any way to put them on the right track, then I would call that a "step forward", rather than taking "two steps back", as it were.
I'm not here to save the world nor do I want to pass myself off as being a martyr, but I really would like to see some kind of change "for the better" and not "for the worse".
By taking a turn for the worse, we're only sending the wrong message and many stand to either not visit Stack or just decide to stay away.
A quality question not only deserves a quality answer, but a "correct" answer; and a correct answer should not be penalized for it.
There's too much elitism being conveyed and that scares people (shy's them) away/turns them right off. By "people", I mean both questioners and answerers alike. None of us like to be fussed at, especially when we are first learning how to do something.
I'm sure there are some (good, intermediate, fantastic coders) who rather not post answers because they feel they'll get downvoted, and that in itself is because there is a certain amount of disdain for it.
I know people rather well and patterns to tell when I'm right about this.
We are after all, only human; as the expression goes. So let us remain "human" and not become a "machine" and to "stay in touch" with the problem at hand by not potentially creating another.
Just so you know:
Anyone who posts an answer for a question that is related to PHP/MySQL that didn't originally involve a prepared statement, stands to get downvoted for it.
Deleted and fetched references edit:
References from deleted questions that were posted before they were deleted, and since the moderators won't undelete them, I had to fetch and paste them all:
Question:
Column count doesn't match value count, but there are 6 values and 6 columns
I got 6 variables, which are sometimes NULL, but NULL is allowed in my DB. And I got 6 columns. Although PHP is giving me the error:
ERROR: Could not able to execute INSERT INTO anmeldungen (FR_PM, SA_AM, SA_PM, SO_AM, SO_PM, MO_AM) VALUES (', , Tobias Glaus, Tobias Glaus, , '). Column count doesn't match value count at row 1
Aso you can see, there are some empty values, but as I said: NULL is allowed in my DB.
<?php
/* Attempt MySQL server connection. Assuming you are running MySQL
server with default setting (user 'root' with no password) */
$link = mysqli_connect("hostname", "username", "password", "database");
// Check connection
if($link === false){
die("ERROR: Could not connect. " . mysqli_connect_error());
}
// Escape user inputs for security
$name1 = mysqli_real_escape_string($link, $_REQUEST['plannercolumn1']);
$name2 = mysqli_real_escape_string($link, $_REQUEST['plannercolumn2']);
$name3 = mysqli_real_escape_string($link, $_REQUEST['plannercolumn3']);
$name4 = mysqli_real_escape_string($link, $_REQUEST['plannercolumn4']);
$name5 = mysqli_real_escape_string($link, $_REQUEST['plannercolumn5']);
$name6 = mysqli_real_escape_string($link, $_REQUEST['plannercolumn6']);
// attempt insert query execution
$sql = "INSERT INTO anmeldungen (FR_PM, SA_AM, SA_PM, SO_AM, SO_PM, MO_AM) VALUES ('$name1, $name2, $name3, $name4, $name5, $name6')";
if(mysqli_query($link, $sql)){
echo "Name ", $name1, " erfolgreich eingetragen. Wir freuen uns auf dich!";
} else{
echo "ERROR: Could not able to execute $sql. " . mysqli_error($link);
}
// close connection
mysqli_close($link);
?>
So what is my fault?
Answers for it:
1)
Each value must be surrounded by '
$sql = "INSERT INTO anmeldungen
(FR_PM, SA_AM, SA_PM, SO_AM, SO_PM, MO_AM)
VALUES
('$name1', '$name2', '$name3', '$name4', '$name5', '$name6')";
2)
Your query should be like this:
$sql = "INSERT INTO anmeldungen
(FR_PM,SA_AM,SA_PM,SO_AM,SO_PM,MO_AM)
VALUES ('$name1','$name2','$name3','$name4','$name5','$name6')";
Your syntax is incorrect.. Refer to this article INSERT QUERY
Question:
Reference: https://stackoverflow.com/questions/42337865/insert-query-not-being-fired
Insert query not being fired
I am creating a registration form that updates the data into the MySQL database. While registration when I click on Register then I see the records not being updated in the database but I successfully move to the successful login page. The code is :
<html>
<head><title>Register a account</title></head>
<body>
<form action= "registerd.php" method = "POST">
ID: <input type= "text" name = "id">
<br/>Name: <input type = "text" name = "name">
<br/>Username: <input type = "text" name = "username">
<br/>Password: <input type = "password" name = "password">
<br/>Confirm Password: <input type = "password" name = "repassword">
<br/><input type="submit" name = "submit" value = "submit"> or <a href="index.php">Login</a>
</form>
</body>
</html>
<?php
session_start();
if(isset($_POST['submit'])){
echo "inside submit";
$id = $_POST['id'];
$name = $_POST['name'];
$username = $_POST['username'];
$password = $_POST['password'];
$repassword = $_POST['repassword'];
if($password==$repassword){
$connect = mysqli_connect("localhost","root", "","login") or die("Couldn't connect to database");
$query = mysqli_query($connect,"INSERT INTO users (id,name,username,password) VALUES ($id,$name,$username,$password)");
echo "query fired";
}
}
?>
Please suggest.
Answers given:
1)
$query = mysqli_query($connect,"INSERT INTO users (id,name,username,password) VALUES ($id,$name,$username,$password)");
echo "INSERT INTO users (id,name,username,password) VALUES ('$id','$name','$username','$password')"; //echo your query
die(); //stop yourscript
try to insert this query into SQL directly and you'll see the problem. I've an idea that your $id in set to auto-increment.
2)
you didnt use quotes on strings.
$query = mysqli_query($connect,"INSERT INTO users (id,name,username,password) VALUES ($id,'$name','$username','$password')");
I really really recommend that you use prepared statements instead of this code though, with this you are vulnerable to SQL Injection
Also do you really want to store the actual password in the DB?
edit: since you mentioned in a comment to another answer that your id is auto incremented, leave out the id in your query like so: (you still need to put quotes though ;))
$query = mysqli_query($connect,"INSERT INTO users (name,username,password) VALUES ('$name','$username','$password')");
edit2: if that still doesn't work, echo the error with mysqli_error():
if(!$query = mysqli_query($connect,"INSERT INTO users (name,username,password) VALUES ('$name','$username','$password')")){
echo 'query failed: '.mysqli_error($connect);
die();
}
3)
You can try $query = mysqli_query($connect,"INSERT INTO user (name,username,password) VALUES ('".$name."','".$username."','".$password."')"); this this way to insert it. here i'm using id as auto increment column.
Question:
capture array values from input fields using php in mysqli
Hello guys i've seen a tutorial from this website HERE by Saran Chamling
Where it is called Capture Array Values from Dynamic input Fields using PHP
so here is the html file
<form method="post" action="collect_vals.php">
<div class="input_fields_wrap">
<button class="add_field_button">Add More Fields</button>
<div><input type="text" name="mytext[]"></div>
<div><input type="text" name="mytext[]"></div>
<div><input type="text" name="mytext[]"></div>
<div><input type="text" name="mytext[]"></div>
<div><input type="text" name="mytext[]"></div>
</div>
</form>
next is the full php code where it will saved the array input fields collect_val.php
<?php
//Open a new connection to the MySQL server
$mysqli = new mysqli('host','username','password','database_name');
//Output any connection error
if ($mysqli->connect_error) {
die('Error : ('. $mysqli->connect_errno .') '. $mysqli->connect_error);
}
$capture_field_vals ="";
if(isset($_POST["mytext"]) && is_array($_POST["mytext"])){
$capture_field_vals = implode(",", $_POST["mytext"]);
}
//MySqli Insert Query
$insert_row = $mysqli->query("INSERT INTO table ( captured_fields ) VALUES( $capture_field_vals )");
if($insert_row){
print 'Success! ID of last inserted record is : ' .$mysqli->insert_id .'<br />';
}
?>
I know hot to insert data but not in array, can someone help me with this? Thank you
Answer given:
The value that you're capturing is a string so change
$insert_row = $mysqli->query("INSERT INTO table ( captured_fields ) VALUES( $capture_field_vals )");
to
$insert_row = $mysqli->query("INSERT INTO table ( captured_fields ) VALUES( '$capture_field_vals' )");
just add quote to '$capture_field_vals'
.
Question:
Reference: https://stackoverflow.com/questions/18869513/php-insert-into-not-working
PHP Insert Into not Working?
For some reason the php insert into is not working for me and just goes to the die.
<form action="user_create.php" method="post">
Forename: <input type="text" name="forename"><br>
Surname: <input type="text" name="surname"><br>
Username: <input type="text" name="username"><br>
Password: <input type="text" name="password"><br>
Email: <input type="text" name="email"><br>
<input type="submit" value="Create User"><br>
</form>
And here is my php code:
$forename = $_POST['forename'];
$surname = $_POST['surname'];
$username = $_POST['username'];
$password = $_POST['password'];
$email = $_POST['email'];
$insert = "INSERT INTO users (id, forename, surname, username, password, email)
VALUES(
''
,$forename
,$surname
,$username
,$password
,$email)";
echo("$forename");
echo("$surname");
echo("$username");
echo("$password");
echo("$email");
mysqli_query($con, $insert) or die ('Error');
mysqli_close($con);
?>
For some reason the code does not complete the mysqli_query, it runs the die code.
Answers given:
1)
Note that your values put iside single quotes '
and are escaped by mysqli_real_escape_string
. Consider also apply strip_tags
on them to prevent basic xss.
$forename = mysqli_real_escape_string($con, $_POST['forename']);
$surname = mysqli_real_escape_string($con, $_POST['surname']);
$username = mysqli_real_escape_string($con, $_POST['username']);
$password = mysqli_real_escape_string($con, $_POST['password']);
$email = mysqli_real_escape_string($con, $_POST['email']);
$insert = "INSERT INTO users (forename, surname, username, password, email)
VALUES('$forename','$surname','$username','$password','$email')";
echo("$forename");
echo("$surname");
echo("$username");
echo("$password");
echo("$email");
mysqli_query($con, $insert) or die ('Error');
mysqli_close($con);
Also consider such expression instead of just die('Error')
mysqli_query($con, $insert) or die (mysqli_error());
This will help you to know what's exactly wrong with your query.
2)
You are inserting a string, use quotes around it like this:
$insert = "INSERT INTO users (id, forename, surname, username, password, email)
VALUES(
''
,'$forename'
,'$surname'
,'$username'
,'$password'
,'$email')";
You don't need quotes around numbers, but you will need them around strings. Otherwise, what would happen if I entered "bob,hithere" as my username? The poor database would think it was two columns.
Secondly, the way you are inserting has some serious security problems. Tricky folk could easily construct a value that would compromise your database.
This is a good link to a question that will tell you why you should change the way you insert data into your database.
3)
Don't insert a ID by leaving it empty, just don't insert one :)
$forename = $_POST['forename'];
$surname = $_POST['surname'];
$username = $_POST['username'];
$password = $_POST['password'];
$email = $_POST['email'];
$insert = "INSERT INTO users (forename, surname, username, password, email) VALUES('$forename','$surname','$username','$password','$email')";
echo("$forename");
echo("$surname");
echo("$username");
echo("$password");
echo("$email");
mysqli_query($con, $insert) or die ('Error');
mysqli_close($con);
?>
As you can see, all valid and correct answers that were downvoted because they didn't rewrite them using a prepared statement.
Some of them already included an escaping function, but that didn't seem to satisfy a few elitists.