Member Avatar for Millsy013 
//create and issue the first query
    $add_topic_sql = "INSERT INTO forum_topics (topic_title, topic_create_time, topic_owner) VALUES ('$_POST[topic_title]',now(),'$_POST[topic_owner]')";
	$add_topic_res = mysql_query($conn, $add_topic_sql)
	or die(mysql_error($conn));
			//get the id of the last query
			$topic_id = mysql_insert_id($mysql);
Edited by Ezzaral because: Fixed code tags.
  • 4 Contributors
  • 4 Replies
  • 105 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by network18

Dani AI

Generated

Brief summary: correctly pointed out the argument/usage problems in the original snippet, and rightly warned about using raw POST data. The thread shows two separate issues: (1) mismatched API calls/parameters and (2) unsafe input handling. Those fixes are necessary, but better is to stop using the old ext/mysql approach entirely and use a single modern API with prepared statements.

Example approach (uses PDO with exceptions and prepared statements — different API than what appeared in the thread):

$title = trim($_POST['topic_title'] ?? '');
$owner = trim($_POST['topic_owner'] ?? '');

$pdo = new PDO('mysql:host=localhost;dbname=your_db;charset=utf8mb4', 'db_user', 'db_pass', [
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
]);

$stmt = $pdo->prepare('INSERT INTO forum_topics (topic_title, topic_create_time, topic_owner) VALUES (:title, NOW(), :owner)');
$stmt->execute(['title' => $title, 'owner' => $owner]);

$topicId = $pdo->lastInsertId();

Notes and troubleshooting tips:

  • Do not mix ext/mysql, mysqli, and PDO. Pick one and use it consistently. 's suggestion to escape input is fine only if you use the same API; prepared statements are safer and simpler.
  • If you keep procedural mysqli, use its prepared-statement APIs and the correct connection variable when asking for the inserted id.
  • For debugging enable exceptions and error reporting on a development machine instead of dying with raw error output in production.
  • Verify PHP version and extensions (ext/mysql was removed in PHP 7+). For guidance on choosing and using modern APIs, see the PHP manual on choosing an API and on prepared statements: Choosing an API, PDO prepared statements, PDO::lastInsertId.

Short caution: always validate and constrain user input (length, allowed characters) before inserting into the database.

Recommended Answers

All 4 Replies

Member Avatar for phouse512

What is the problem?

One thing that you could do to make the code better is instead of using the POST array in the actual query, you could clean it up and store it in another variable first, something like:

$topic_owner = mysqli_real_escape_string($conn, trim($_POST['topic_owner']));
Member Avatar for network18 
//create and issue the first query
    $add_topic_sql = "INSERT INTO forum_topics (topic_title, topic_create_time, topic_owner) VALUES ('$_POST[topic_title]',now(),'$_POST[topic_owner]')";
	$add_topic_res = mysql_query($conn, $add_topic_sql)
	or die(mysql_error($conn));
			//get the id of the last query
			$topic_id = mysql_insert_id($mysql);

You messed up with parameters of the mysql_query(), it should have been -

mysql_query($add_topic_sql, $conn)
Member Avatar for Hummdis

From what I can tell, network18's got it.

Member Avatar for network18 
$topic_id = mysql_insert_id($mysql);

is wrong too.mysql_insert_id() expects the MySQL link parameter.
It should have been like -

$topic_id = mysql_insert_id($conn);
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.