使用php从表单输入数据到数据库

Question

I am trying to enter data into the database but I keep getting an error. I have no idea where the problem is. Here is the code:

<?php 
  $sql = "INSERT INTO $db_table (title,group,overlapok,userid,name,phone,email,description,managers,location,notify,notifyman,
remind,remindman,appmsg,viewaccess,viewulist,viewclist,makeaccess,makeulist,makeclist,showappinfo) 
VALUES ('".mysql_real_escape_string(stripslashes($_REQUEST['txtTitle'])).
"','".mysql_real_escape_string(stripslashes($_REQUEST['chkGroupCal'])).
"','".mysql_real_escape_string(stripslashes($_REQUEST['chkAllowOverlap'])).
"','".mysql_real_escape_string(stripslashes($_REQUEST['txtUserID'])).
"','".mysql_real_escape_string(stripslashes($_REQUEST['txtOwner'])).
"','".mysql_real_escape_string(stripslashes($_REQUEST['txtPhone'])).
"','".mysql_real_escape_string(stripslashes($_REQUEST['txtEmail'])).
"','".mysql_real_escape_string(stripslashes($_REQUEST['txtDesc'])).
"','".mysql_real_escape_string(stripslashes($_REQUEST['txtManagers'])).
"','".mysql_real_escape_string(stripslashes($_REQUEST['txtLocation'])).
"','".mysql_real_escape_string(stripslashes($_REQUEST['chkNotifyMe'])).
"','".mysql_real_escape_string(stripslashes($_REQUEST['chkNotifyMgrs'])).
"','".mysql_real_escape_string(stripslashes($_REQUEST['chkRemind'])).
"','".mysql_real_escape_string(stripslashes($_REQUEST['chkRemindMan'])).
"','".mysql_real_escape_string(stripslashes($_REQUEST['txtAppText'])).
"','".mysql_real_escape_string(stripslashes($_REQUEST['selViewBlockRestr'])).
     "','".mysql_real_escape_string(stripslashes($_REQUEST['txtViewBlocksUserID']))
   "','".mysql_real_escape_string(stripslashes($_REQUEST['txtViewBlocksCourseID']))."','".mysql_real_escape_string(stripslashes($_REQUEST['selMakeApptRestr']))."','".mysql_real_escape_string(stripslashes($_REQUEST['txtMakeApptUserID']))."','".mysql_real_escape_string(stripslashes($_REQUEST['txtMakeApptDptID']))."','".mysql_real_escape_string(stripslashes($_REQUEST['chkShowAppInfo']))."')"; 

if($result = mysql_query($sql,$db)) 
   {
    echo '<h1>Thank you</h1> Your information has been entered into our database<br><br>
        <p> <a href="viewcalendar.page.php"> View Calendar </a> </p>
        <img src="eDiary.jpg"';

    } 
   else 
   {
    echo "ERROR: ";
   }  ?>

The form includes sections where there are check boxes that can be left blank.

I followed your advice and used PDO. Kept returning the following error:Warning: PDO::__construct() [pdo.--construct]: [2002] Invalid argument (trying to connect via unix://) in /opt/lampp/htdocs/Scheduler/pages/enterCal.page.php on line 72 Connection Failed: SQLSTATE[HY000] [2002] Invalid argument Fatal error: Call to a member function exec() on a non-object in /opt/lampp/htdocs/Scheduler/pages/enterCal.page.php on line 80.

I figured $db is not an object and that the connection is not being executed. How do I take care of that? I've tried Google but can't seem to come up with anything that works.

    <?php

$dsn = 'mysql:host=localhost;dbname=eDiary';
$user = 'root';
$password = '';

try 
{
        $db = new PDO($dsn,$user,$password);
        $db -> setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);}                
catch (PDOException $e) {
  echo 'Connection Failed: ' . $e->getMessage();
    }

$result = $db->exec("INSERT INTO wassCalendar(title, group, overlapok, userid, name, phone, email, description, managers, location, notify, notifyman, remind, 
remindman, appmsg, viewaccess, viewulist, viewclist, makeaccess, makeulist, makeclist, showappinfo) 
VALUES($txtTitle, $chkGroupCal, $chkAllowOverlap, $txtUserID, $txtOwner,  $txtPhone, $txtEmail, $txtDesc, $txtManagers, 
$txtLocation, $chkNotifyMe, $chkNofityMgrs, $chkRemind, $chkRemindMan, $txtAppText, $selViewBlockRestr, 
$txtViewBlocksUserID, $txtViewBlocksCourseID, $selMakeApptRestr, $txtMakeApptUserID, $txtMakeApptDptID, 
$chkShowAppInfo)"; 

$insert_id = mysql_insert_id();

?>

Answer 1

When in a situation that requires using user input in a query, you will want to parameterize the query.

Here is another topic where I cover the same issue.

Relying on sanitizing the input is incredibly bad practice, and will eventually bite you.