whats wrong with this php code?

[chrisx16x2008]

Code: Select all

<?php
mysql_connect('host', 'user', 'pass');
mysql_select_db(database);
$user = $_POST['user'];
$pass = $_POST['pass'];
$passconf = $_POST['passconf'];
$type = $_POST['type'];
$location = $_POST['location'];
$description = $_POST['description'];
mysql_query("INSERT INTO users VALUES ('$user','$pass','$passconf','$type','$location','$description'");
?>

It goes through but then i check the database and it wasn't submitted... Also after i get this code to submit do i go about extracting the values from the database and printing them on a page?

[Xive]

First of all you might wanna remove your Sql database credentials from your post.
about the code.. you need to double quote the db name:

Code: Select all

mysql_select_db('db_name');

and to extract data from the db, check this site out.
also i recommend adding some sanitization to your user's input to avoid xss.
Rule to live by: Never trust your user's input

[chrisx16x2008]

THANK YOU! finally got it working, it was the quotes and also i found another problem which was i forgot a ")". Also yea thanks for the tip on not posting my credentials and xss, usually careful about that that kind of stuff.