php mysql_query returns nothing after insert (and nothing is inserted either)

I've got the following code:

    <?php
  if(!empty($error_msg))
   print("$error_msg"); 
  else
  { 
   require_once("../include/db.php");

   $link = mysql_connect($host,$user,$pass);
   if (!$link) 
    pr开发者_如何学Pythonint('Could not connect: ' . mysql_error());
   else
   {      
    $sql = "insert into languages    values(NULL,'$_POST[language]','$_POST[country_code]');";
    $res = mysql_query($sql);

    print("$sql<br>\n");
    print_r("RES: $res");
    mysql_close($link);
   }
  }
 ?>

In one word: it does not work. mysql_query doesn't return anything. If I try the same query within php_myadmin, it works. It does not insert anything either. Also tried it as user root, nothing either. Never had this before. Using mysql 5.1 and PHP 5.2.

Any ideas?

---

mysql_query will return a boolean for INSERT queries. If you var_dump $res you should see a boolean value being printed. It will return TRUE for a successful query, or FALSE on error. In no cases it ever returns NULL.

In addition, never pass input data (e.g.: $_POST) directly to an SQL query. This is a recipe for SQL injection. Use mysql_real_escape_string on it first:

$language = mysql_real_escape_string($_POST['language']);
$sql = "INSERT INTO language SET language='$language'";

And don't forget to quote your array indices (e.g.: $_POST['language'] instead of $_POST[language]) to prevent E_NOTICE errors.

---

You need to specify a database so the system knows which database to run the query on...

http://php.net/manual/en/function.mysql-select-db.php

Without selecting a database, your data will not be inserted

---

mysql_query returns a boolean for INSERT queries. If used in string context, such as echo "$res", true will be displayed as 1 and false as an empty string. A query error has possibly occured. Use mysql_error() to find out why the query has failed.

$sql = "insert into languages    values(NULL,'$_POST[language]','$_POST[country_code]');";

This is very bad practise, as a malicious user can send crafted messages to your server (see SQL Injection).

You should at least escape the input. Assuming your column names are named 'language' and 'country_code', this is a better replacement for the above code:

$sql = sprintf('INSERT INTO LANGUAGES (language, country_code) VALUES ("%s","%s")',
    mysql_real_escape_string($_POST['language']),
    mysql_real_escape_string($_POST['country_code'])
   );

For a description of the mysql_real_escape_string function, see the PHP Manual. For beginners and experienced programmers, this is still the best resource for getting information about PHP functions.

Instead of using $_POST directly, I suggest using the filter_input() function instead. It's available as of PHP 5.2.

---

With an INSERT query, mysql_query returns true or false according as the query succeeded or not. Here it is most likely returning false. Change the line print_r("RES: $res"); to print_r("RES: ".(int)$res); and most likely you will see it print RES: 0.

The problem may be that MySQL expects a list of column names before the VALUES keyword.

Also, you appear to be inserting POST variables directly into SQL - you should read up on SQL injection to see why this is a bad idea.

---

--I retract the quote comment, but still not good to directly insert $_POST values.--

Second, I don't think i've seen print_r quite used like that, try just using an echo.

And mysql_query is only expected a boolean back on an INSERT, what are you expecting?

---

Now ive got this:

$language = mysql_real_escape_string($_POST['language']); $country_code = mysql_real_escape_string($_POST['country_code']);

            $sql = "insert into shared_content.languages (id,language,country_code) values(NULL,$language,$country_code);";
            $res = mysql_query($sql);

            print("$sql<br>\n");
            var_dump($res);
            print(mysql_error());
            mysql_close($link);

And the output:

insert into shared_content.languages (id,language,country_code) values(NULL,NETHERLANDS,NL); bool(false) Unknown column 'NETHERLANDS' in 'field list'