PHP HTML Forums & Javascript for entering Database Information

[Hallowed]

Soo... I'm a newb and need some help. I know this is a java forum, but I've yet to find anywhere else with such great members and support. =P

I know this is a lot of information, so thank you for your time =]

I'm trying to do a basic website in which I accept information via fields and then insert them into my database. I've got it to the point in which I can create a database via html and display data already in the database.

I have been using this tutorial to get me to where I'm at now:
PHP/MySQL Tutorial - Part 1

Here is the code I'm using for the form section.:

<!--Input Table-->
<form action="newsInsert.php" method="postNews">
Date: <input type="text" name="day" hspace="2" maxlength="2">/<input type="text" name="month" hspace="2" maxlength="2">/<input type="text" name="year" hspace="4"  maxlength="4"><br>
Title: <input type="text" name="title" maxlength="255"><br>
Location: <input type="text" name="location" maxlength="255"><br>
Other: <input type="text" name="other" maxlength="255"><br>
<input type="Submit" value="Submit">
</form>

From what I understand this (when submit is clicked) passes the information via a url to my newsInsert.php page. As I get a url that looks like this when i click it: (filled out with 01 01 0001 Test Test Test)
http://....Net/newsInsert.php?day=01...est&other=Test

So essentially I need help getting that information from there into some java script so I can use the variables in my php to put it in my database.

Here is what I've done so far on my newsInsert.php page.

<script language="JavaScript">
 
function postNews(dateR, titleR, locationR, otherR)
{
var date = 'dateR';
var title = 'titleR';
var date = 'locationR';
var date = 'otherR';
}
 
</script>

<?

//the below section contains password information to log into my datbase =/ just fyi
include("NewsDB.AiNFO.php");

$date=$_POST['date'];
$title=$_POST['title'];
$location=$_POST['location'];
$other=$_POST['other'];

mysql_connect(localhost,$username,$password);
@mysql_select_db($database) or die( "Unable to select database");

$query = "INSERT INTO news VALUES ('','$date','$title','$location','$other')";
mysql_query($query);

mysql_close();
?>

I don't know how to associate the javascript variables with variables inside my php. And I don't know if my parameters the way they are set up with the forum actually are getting the data or not.

And finally I'm confused by some of the php code:

$query = "INSERT INTO news VALUES ('','$date','$title','$location','$other')";
mysql_query($query); 

^How does this get into my database? I see that it uses variable $query to put in all the other variables into one.. and then we call that variable $query with mysql_query()? sooo... it's saying to run mysql_query() which is php to say to run something as SQL i assume? and the INSERT INTO news Values will put that data () into my database? Sound about right? The reason i ask is cause I was trying to use sample code prior to this to put in information into my news DB and it wasn't going in. Is there something missing in the php section?

I figure I better include this in case it becomes important for an answer or anyone else trying to learn from this question. This is the php i used to set up my table in my news DB:

<?php
//Creates a "news" Table in News Database if its not there, with the fields.    

include("NewsDB.AiNFO.php");
mysql_connect(localhost,$username,$password);
@mysql_select_db($database) or die( "Unable to select database");
$query="CREATE TABLE news (id int(100) NOT NULL auto_increment,date varchar(10) NOT NULL,title varchar(255) NOT NULL,location varchar(255) NOT NULL,other varchar(255) NOT NULL,PRIMARY KEY (id),UNIQUE id (id),KEY id_2 (id))";
mysql_query($query);
mysql_close();


    
?>

Is it even required that I use javascript to get these variables from the forum? Or can I do it directly with php?

[copeg]

So essentially I need help getting that information from there into some java script so I can use the variables in my php to put it in my database.

I'm not truly sure what javascript has to do with this...do you want to be able to do something with the values client side? If not, then there is no reason

How does this get into my database?

msyql_query calls the passed SQL query to your database. You pass an insert string, which will insert the given values (assuming your query is syntactically correct). Did you run the code? Does it work? For testing, add a die statement and pass the result from calling mysql_error()

mysql_query($query) or die(mysql_error()); //remove the die for production environments.

A word of warning: verify all user submitted information! Depending upon your configuration, someone could quite readily pass information that results in your code hacking your database - for instance dropping your entire database - if you don't know why or how, I recommend reading about SQL injection.

[Hallowed]

So truly I have no need to do anything with the values client side. The only trouble is that, well I guess since I was following the guidelines from that website, he advised that users send the form information to newsInsert.php, which is another webpage.

So I'm really just trying to pass all my information from my input form into my database for now.

As far as it working, i know the database creation part works and it holds data as intended, and that my out put part works (which is irrelevant since its not on here).
But I've been focused trying to get the variables from my forms into variables in php via some sort of parameter, so I can then try to get it into my DB. I'm not sure how to go about collecting the data from the forms.

In short how would I get this:

<!--Input Table-->
<form action="newsInsert.php" method="postNews">
Date: <input type="text" name="day" hspace="2" maxlength="2">/<input type="text" name="month" hspace="2" maxlength="2">/<input type="text" name="year" hspace="4"  maxlength="4"><br>
Title: <input type="text" name="title" maxlength="255"><br>
Location: <input type="text" name="location" maxlength="255"><br>
Other: <input type="text" name="other" maxlength="255"><br>
<input type="Submit" value="Submit">
</form>

Into some php variables, so I can then attempt to pass the information into my database.

Also thanks for the tip about sql injection. I will look into that a lot more once I get this basic part up and running.


Also maybe to explain myself better this is what the author says:
"This script should then be saved as insert.php so that it can be called by the HTML form. It works because, instead of the data being entered locally, it is being entered into the form and stored in variables which are then passed to the PHP."

[Hallowed]

I did a little bit more editing and I just tried taking out the JavaScript all together from my newsInsert.php page. So now all I have in there is

<? 
 
//the below section contains password information to log into my datbase =/ just fyi 
include("NewsDB.AiNFO.php"); 
 
$date=$_POST['date']; 
$title=$_POST['title']; 
$location=$_POST['location']; 
$other=$_POST['other']; 
 
mysql_connect(localhost,$username,$password); 
@mysql_select_db($database) or die( "Unable to select database"); 
 
$query = "INSERT INTO news VALUES ('','$date','$title','$location','$other')"; 
mysql_query($query); 
 
mysql_close(); 
?>

What my database is showing when I click submit is that a new row is created and it's blank... Any thoughts?


----

Just realized i am missing so essential parts in my database, since I'm breaking up the dates by day month and year.. I'll be back..

[Hallowed]

Well I got it working. Found out that apparently renaming the form method to something other than post will break it.. ha.

[copeg]

Well I got it working. Found out that apparently renaming the form method to something other than post will break it.. ha.

You should pass the information using either GET or POST (google these for more information). Default is GET, and in the php code you posted above you were requesting variables via the POST method (which will then be blank). Changing the method (either in the form or the ultimate page - so they match) will solve, as will using the $_REQUEST variables, which contain both GET, POST, and COOKIE information