insert - MySQL query runs without error but does not populate database -
evening folks,
having of "looked @ long moments".
this code when run return success message nothing gets entered database table, no errors being thrown up, know correct values being received _post can't see what's wrong, have identical query on page , works fine.
can see issues code?
if (isset($_post['username']) && $_post['username'] !== '') { $salted = md5($_post['pass1'] . 'salt'); try { $sql = 'insert users set username = :username, firstname = :firstname, lastname = :lastname, email = :email, password = $salted, joined = curdate()'; $s = $pdo->prepare($sql); $s -> bindvalue(':username', $_post['username']); $s -> bindvalue(':firstname', $_post['firstname']); $s -> bindvalue(':lastname', $_post['lastname']); $s -> bindvalue(':email', $_post['email']); $s -> execute(); } catch (pdoexception $e) { $error = 'error adding submitted user.'; echo $error; exit(); } ?> <div class="alert alert-success">user added database.</div> <?php }
summarizing comments here, sake of having answer. marked community wiki.
a string in insert statement should quoted.
password = '$salted',
you should use parameter anyway.
password = :password, . . . $s -> bindvalue(':password', $salted);
md5 isn't preferred hashing function modern strong password storage. neither sha1.
try use sha256 or bcrypt instead.$salted = hash('sha256', $_post['pass1'] . 'salt');
salting better if use random salt string per user.
make sure pdo instance configured throw exceptions.
$pdo->setattribute(pdo::attr_errmode, pdo::errmode_exception);
always capture pdo exception's error message, if don't output users.
error_log($e->getmessage());
Comments
Post a Comment