Php and mysql insert

Question

I have the next code, but it inserts two rows in the mysql database instead of one. Could ypu please take a look to the code?

Regards.

            <?php
            $name=  $_POST['name'];
                    $password = $_POST['password'];

            mysql_connect("localhost","username","mypass");


            mysql_select_db("databaseName"); 


            mysql_query($query ="insert into users(name,password) values ('$name','$password')");

            if (mysql_query($query) === TRUE) {
                echo "Record saved";
            } else {
                echo "Error";
            }
            ?>

[Your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) — Jay Blanchard, Jul 14 '15 at 19:44
If you can, you should [stop using `mysql_*` functions](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php). They are no longer maintained and are [officially deprecated](https://wiki.php.net/rfc/mysql_deprecation). Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) [statements](http://php.net/manual/en/pdo.prepared-statements.php) instead, and consider using PDO, [it's really not hard](http://jayblanchard.net/demystifying_php_pdo.html). — Jay Blanchard, Jul 14 '15 at 19:45
[Don't limit passwords](http://jayblanchard.net/security_fail_passwords.html) and [use the proper methods to hash and verify passwords with PHP](http://jayblanchard.net/proper_password_hashing_with_PHP.html). — Jay Blanchard, Jul 14 '15 at 19:45
Add error reporting to the top of your file(s) right after your opening ` — Jay Blanchard, Jul 14 '15 at 19:46
Thank you for all your comments. I'm going to use PDO to enhance the code. — Fran Rod, Jul 14 '15 at 19:48
The question has some grammar problems, but other than that it's fine. It certainly shouldn't be downvoted because the answer is obvious to some. — kdbanman, Jul 14 '15 at 20:02

score 1 · Accepted Answer · answered Jul 14 '15 at 19:53

Don't call mysql_query() when you assign the $query variable. And remember to escape your data, since you're not using prepared statements.

mysql_connect("localhost","username","mypass");
$name = mysql_real_escape_string($_POST['name']);
$password = mysql_real_escape_string($_POST['password']);

$query ="insert into users(name,password) values ('$name','$password')";

if (mysql_query($query)) {
    echo "Record saved";
} else {
    echo "Error: " . mysql_error();
}

captain_a · Answer 2 · 2015-09-01T14:52:41.980

0

Dont use the mysql_query function twice, you want to check it in if statement, then dont call it before if clause. See this following code.

$query ="insert into users(name,password) values ('$name','$password')"

if (mysql_query($query) === TRUE) {
echo "Record saved";
} else {
echo "Error";
}

edited Sep 01 '15 at 14:52

answered Jul 14 '15 at 19:57

captain_a

3,209
1
12
23

Php and mysql insert

2 Answers2