Why is php entering data before i press submit

Question

I dont have previous experience with PHP or SQL so i didnt quite catch everything and i have done this by previous various templates/examples, i manage to connect my form to database but it creates record on load before i enter data and press submit and i cant figure out why, also when i fill form and press submit, it takes me to home page should it do that way (and does not fill in data in table), here is code and thank you in advance!!!

    <html>
<body>

<?php
$servername = "10.253.---.--";
$username = "intranet";
$password = "----";
$dbname = "intranet";

// Create connection
$conn = mysqli_connect($servername, $username, $password, $dbname);
// Check connection
if (!$conn) {
    die("Connection failed: " . mysqli_connect_error());
}

$sql = "INSERT INTO AdresarGIS (Adresa, Broj, Mesto, Agent, Komentar)
VALUES ('$_POST[Adresa]','$_POST[Broj]','$_POST[Mesto]','$_POST[Agent]','$_POST[Komentar]' )";

if (mysqli_query($conn, $sql)) {
    echo "New record created successfully";
} else {
    echo "Error: " . $sql . "<br>" . mysqli_error($conn);
}

mysqli_close($conn);
?>

    <form method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>">
        <p>
        <label for="Adresa">Adresa</label><br/>    
        <input type="text" name="Adresa" />
        </p>
        <p>
        <label for="Broj">Broj</label><br/>    
        <input type="text" name="Broj" />
        </p>
         <p>
        <label for="Mesto">Mesto</label><br/>    
        <input type="text" name="Mesto" />
        </p>
         <p>
        <label for="Agent">Agent</label><br/>    
        <input type="text" name="Agent" />
        </p>
         <p>
        <label for="Komentar">Komentar</label><br/>    
        <input type="text" name="Komentar" />
        </p>
        <p>
            <input type="submit" name="submit" value="Pošalji" />
        </p>
    </form>   

</body>
</html>

Because you don't check to see if the form is submitted so the the code is executed when the page loads — John Conde, Aug 16 '16 at 12:52
how may i do that ? I asume something like this : if ($_POST["submit"] === "submit" { $sql = "INSERT INTO AdresarGIS (Adresa, Broj, Mesto, Agent, Komentar) VALUES ('$_POST[Adresa]','$_POST[Broj]','$_POST[Mesto]','$_POST[Agent]','$_POST[Komentar]' )"; } — Aleksandar Stankovic, Aug 16 '16 at 12:54
hint: `if not empty...` http://php.net/manual/en/function.empty.php and isset http://php.net/manual/en/function.isset.php — Funk Forty Niner, Aug 16 '16 at 12:54
*" I asume something like this..."* - you got it Pontiac ;-) in addition to what I wrote above. — Funk Forty Niner, Aug 16 '16 at 12:56
@Fred-ii- it is on private intranet site so i avoided injection prevention, since im not skilled enough — Aleksandar Stankovic, Aug 16 '16 at 12:56
you are putting way too much trust in people. Remember this: *"Even your best friend will (ahem) you"*. — Funk Forty Niner, Aug 16 '16 at 12:56
@Fred-ii- thanks for the help very much! i will read it in detail and try to solve it, will also work on injection prevention :D — Aleksandar Stankovic, Aug 16 '16 at 12:59
you're welcome. *Stay safe, even in the workplace* ;-) most accidents happen there. — Funk Forty Niner, Aug 16 '16 at 12:59

score 2 · Answer 1 · edited May 23 '17 at 12:14

2

Because you don't check to see if the form is submitted so the the code is executed when the page loads. There are a few ways to do this but simply checking if the page was requested via the POST method is the simplest:

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    /// your code goes here
}

FYI, you are wide open to SQL injections.

edited May 23 '17 at 12:14

Community

1
1

answered Aug 16 '16 at 12:56

John Conde

207,509
96
428
469

let's not forget `empty()` ;-) on the "if not". – Funk Forty Niner Aug 16 '16 at 12:57
Yeah, they need to add validation as well but that's beyond the scope of the initial question. :) – John Conde Aug 16 '16 at 12:59

Mamta · Answer 2 · 2016-08-16T13:03:02.240

As mentioned in Comments You have not checked either your form is posted or not that's why you are getting blank values in your database do this. Use isset for this

1) use isset($_POST['submit']) to check form data is posted or not

2) Also check posted vales is not empty if empty then show errors

like

    if(isset($_POST['submit'])){
    if(empty($_POST['Adresa']) || empty($_POST['Broj'])|| empty($_POST['Mesto'])|| empty($_POST['Agent'])|| empty($_POST['Komentar'])){
        echo "Please fill all fields";

    }else {
$sql = "INSERT INTO AdresarGIS (Adresa, Broj, Mesto, Agent, Komentar)
VALUES ('$_POST[Adresa]','$_POST[Broj]','$_POST[Mesto]','$_POST[Agent]','$_POST[Komentar]' )";

if (mysqli_query($conn, $sql)) {
    echo "New record created successfully";
} else {
    echo "Error: " . $sql . "<br>" . mysqli_error($conn);
}

mysqli_close($conn);
}
}

score 0 · Answer 3 · edited Aug 16 '16 at 15:26

0

if(isset($_POST['your btn name']))
{
    //your insert query
}

edited Aug 16 '16 at 15:26

Ashley Medway

6,659
7
43
63

answered Aug 16 '16 at 12:57

Karthi

518
1
4
15

While this code snippet may solve the question, [including an explanation](//meta.stackexchange.com/questions/114762/explaining-entirely-code-based-answers) really helps to improve the quality of your post. Remember that you are answering the question for readers in the future, and those people might not know the reasons for your code suggestion. Please also try not to crowd your code with explanatory comments, as this reduces the readability of both the code and the explanations! – Goodbye StackExchange Aug 16 '16 at 14:08

score 0 · Answer 4 · answered Aug 16 '16 at 13:00

you have to check if the form is submitted or not

<?php
$servername = "10.253.---.--";
$username = "intranet";
$password = "----";
$dbname = "intranet";
if(isset($_REQUEST['submit']){    // check if the form is submitted
    // Create connection
    $conn = mysqli_connect($servername, $username, $password, $dbname);
    // Check connection
    if (!$conn) {
       die("Connection failed: " . mysqli_connect_error());
    }

    $sql = "INSERT INTO AdresarGIS (Adresa, Broj, Mesto, Agent, Komentar)
VALUES ('$_POST[Adresa]','$_POST[Broj]','$_POST[Mesto]','$_POST[Agent]','$_POST[Komentar]' )";

    if (mysqli_query($conn, $sql)) {
        echo "New record created successfully";
     } else {
        echo "Error: " . $sql . "<br>" . mysqli_error($conn);
     }

     mysqli_close($conn);
} // end if
?>

Why is php entering data before i press submit

4 Answers4