PHP/MYSQL problem with $_GET

Hello,

Im trying to push data in an mysql database through the use of global variables in an url. I have no trouble or whatsoever with inserting floats or integers but with a string i’m unable to get it from the url.

Here is my code:

[code]<?php

include(“dbconnect.php”);

$SQL = “INSERT INTO DATA (PanelType, SpanningDC, StroomDC, VermogenDC, SpanningAC, StroomAC, VermogenAC, Rendement, kWh, Lux) VALUES (’”.$_GET[“PanelType”]."’,’".$_GET[“SpanningDC”]."’,’".$_GET[“StroomDC”]."’,’".$_GET[“VermogenDC”]."’,’".$_GET[“SpanningAC”]."’,’".$_GET[“StroomAC”]."’,’".$_GET[“VermogenAC”]."’,’".$_GET[“Rendement”]."’,’".$_GET[“kWh”]."’,’".$_GET[“Lux”]."’)";

mysql_query($SQL);

?>[/code]

This is included

[code]<?php
$servername = “**";
$username = “";
$password = "
”;
$dbname = "
”;

$dbh = mysql_pconnect($servername, $username, $password);
$selected = mysql_select_db($dbname, $dbh)

?>[/code]

and for an example i try to insert data through the url:
http://******/adddata.php?Paneltype=test&SpanningDC=400&StroomDC=60&VermogenDC=200&SpanningAC=0&StroomAC=0&VermogenAC=0&Rendement=40&kWh=360&Lux=400

My database setup:
http://s33.postimg.org/wa728qwhb/Capture.png
(can’t pase images or urls due to not having more than 10 posts, srry for the inconvenience

any help would be very welcome

[size=18pt]STOP RIGHT THERE![/size]

You are using obsolete code that has been completely removed from PHP and your code is vulnerable to an SQL Injection Attack.

You never ever send user supplied data directly to the database!

You need to use PDO with prepared statements.
https://phpdelusions.net/pdo

Sponsor our Newsletter | Privacy Policy | Terms of Service