数据未插入数据库

Question

I have a modal window with a form and it is supposed to submit the field data to the database, not close the modal widow, and then display "You have been RSVP'd" before fading out the modal window.

2 things:

1) On submit, the modal window closes?! It should remain open 2) The data isn't inserting into the database..

Modal window HTML

<form id="rsvp-yes" action="#" method="post" name="rsvp-yes">
<label for="email">Your E-mail</label>
    <input id="email" class="txt" type="email" name="email" />
    <label for="location">Choose your location</label>
    <select name="city" id="city">
    <option value="None Selected" selected>Select</option>
    <option value="Perth">Perth</option>
    <option value="Brisbane">Brisbane</option>
    <option value="Sydney">Sydney</option>
    <option value="Melbourne">Melbourne</option>
    </select>

    <button id="rsvp">RSVP</button></form></div>

JAVASCRIPT

$(document).ready(function() {
        $(".modalbox").fancybox();
        $("#rsvp").submit(function() { return false; });

        function validateEmail(email) { 
        var reg = /^(([^<>()[\]\\.,;:\s@\"]+(\.[^<>()[\]\\.,;:\s@\"]+)*)|(\".+\"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/;
        return reg.test(email);
    }

        $("#rsvp").on("click", function(){
            var emailval  = $("#email").val();
            var city      = $("#city").val();
            var mailvalid = validateEmail(emailval);

            if(mailvalid == false) {
                $("#email").addClass("error");
            }
            else if(mailvalid == true){
                $("#email").removeClass("error");
            }

            if(mailvalid == true) {
                //&& msglen >= 4
                // if both validate we attempt to send the e-mail
                // first we hide the submit btn so the user doesnt click twice
                $("#rsvp").replaceWith("<em>RSVP'ing you...</em>");

                $.ajax({
                    type: 'POST',
                    url: 'rsvp-yes.php',
                    data: $("#rsvp-yes").serialize(),
                    success: function(data) {
                        if(data == "true") {
                            $("#rsvp-yes").fadeOut("fast", function(){
                                $(this).before("<p><strong>You have been RSVP'd</strong></p>");
                                setTimeout("$.fancybox.close()", 1000);
                            });
                        }
                    }
                });

PHP

<?php
$email = $_POST['email'];
$city = $_POST['city'];

mysql_connect(myhost,myuser,mypass) or die("Could not connect: " . 
mysql_error());
mysql_query("USE mydbname");

mysql_query("INSERT INTO rsvp-yes (ID, email, city)
VALUES ('NULL', '".$email"', '".$city"')");

?>

Answer 1

You should use mysql_real_escape_string() function to prevent from SQL injection. It also prevent error on inserting data because of quote or double quote.

$email = $_POST['email'];
$email=mysql_real_escape_string($email);

$city = $_POST['city'];
$city=mysql_real_escape_string($city);

Hope your ID column is a primary key and also an auto incremented field. So you should not include ID on your sql statement.

mysql_query("INSERT INTO rsvp-yes (email, city)
VALUES ('$email', '$city')");