SQL Strings Not Working

I have a PHP script which is ran after a form is submitted. For some reason the SQL strings do not work however I am getting no WSOD or error message to indicate that something is wrong.

I have been over the code plenty of times now, comparing it to other scripts which I have that do work and cannot seem to find anything wrong. If anyone could help me resolve this it would be greatly appreciated.

<?php $con=mysqli_connect("localhost","","","transfer-genie"); if (mysqli_connect_errno()) { echo "Failed to connect to MySQL: " . mysqli_connect_error(); } $firstname = $_POST['firstname']; $lastname = $_POST['lastname']; $pickdrop = $_POST['pickdrop']; $email = $_POST['email']; $contact = $_POST['number']; $requiredseats = $_POST['requiresdeats']; $skis = $_POST['skicarriage']; $transferid = $_POST['transferid']; $itemname = $_POST['itemname']; $query = $con->query("SELECT * FROM transfers WHERE transferid='$transferid'"); while($row = mysql_fetch_array($query)) { $origseats = $row ['spaces']; $origskis = $row ['skicarriage']; } $newseats = $origseats - $requiredseats; $newskis = $origskis - $skis; $sql="INSERT INTO prebookings (firstname, lastname, pickdrop, email, contact, requiredseats, skis, transferid, bookingid) VALUES ('$firstname', '$lastname', '$pickdrop', '$email', '$contact', 'NULL', 'NULL', '$transferid', 'NULL')"; $sql.="UPDATE transfers SET spaces = '$newseats' WHERE transferid = '$transferid'"; $sql="UPDATE transfers SET skicarriage = '$newskis' WHERE transferid = '$transferid'"; if (!mysqli_query($con,$sql)) { die('Error: ' . mysqli_error($con)); } session_start(); $_SESSION['bookingid'] = $transferid; mysqli_close($con); ?>

You have some spelling mistakes like $requiredseats = $_POST[‘requiresdeats’];

Try to dump out the queries and run them manually to see if you spot any problems

Then rewrite all the queries to parameterized queries instead of adding inline variables. You are currently wide open to sql injection/hacking

Another thing is you are mixing mysqli with mysql calls.

Sponsor our Newsletter | Privacy Policy | Terms of Service