mySQL query creating empty columns

Question

Hi guys, I am trying to capture data from my form and pump it into a database, but when I try to input data into a column, I only get the uid, and the rest of the columns are empty.

Here is some code:

mysql_query("INSERT INTO personal_information (uid, name, surname, email, cell) 
VALUES ('".$uid."', '".$name."', '".$surname."', '".$email."', '".$cell."' )")
or die(mysql_error());

mysql_query("INSERT INTO consumer_related_info (uid) 
VALUES ('".$uid."')")
or die(mysql_error());

mysql_query("INSERT INTO family_scenario (uid) 
VALUES ('".$uid."')")
or die(mysql_error());

mysql_query("INSERT INTO lifestyle_activities (uid) 
VALUES ('".$uid."')")
or die(mysql_error());

mysql_query("INSERT INTO occupational_information (uid) 
VALUES ('".$uid."')")
or die(mysql_error());

mysql_query("INSERT INTO sport_activities (uid) 
VALUES ('".$uid."')")
or die(mysql_error());

mysql_query("INSERT INTO vehicle_details (uid) 
VALUES ('".$uid."')")
or die(mysql_error());

What could I be doing wrong?

Answer 1

sending the data with php? then read http://php.net/manual/en/security.globals.php and http://www.php.net/manual/en/language.variables.predefined.php

Edit With the given information its more guessing then debugging. But i would bet that register_globals is the problem here.

What to do? Simple use superglobals.

// assumed the form method is post
$name = mysql_real_escape_string(trim($_POST['name']));
// and so on

If this does not help: fill your form with dummy-values, dump your request-data (and post it here)

echo '<pre>'
     . print_r($_REQUEST, true)
     . '</pre>';
exit; 

Answer 2

Unrelated tip: make sure that the variables you're interpolating are escaped using addslashes to protect against the majority of injection attacks.

Actually... that could be quite related. Quotes and other unescaped characters could lead to the "breaking-out" of the string and cause a MySQL syntax error.

Answer 3

Try this to see if your variables has a value assigned and what it is

$values = array( $uid, $name, $surname, $email, $cell );
print_r( $values );

Check the output.

After that is said. I would execute my queries like this

$query = sprintf( "INSERT INTO personal_information (uid,name,surname,email,cell) VALUES ('%s', '%s', '%s', '%s', '%s')",
mysql_real_escape_string($uid),
mysql_real_escape_string($name),
mysql_real_escape_string($surname),
mysql_real_escape_string($email),
mysql_real_escape_string($cell));

mysql_query($query) or die (mysql_error());

By escaping all the input, you are secure against mysql_injections (i dont know if you are totally secure). This is very important!! I don't know how familiar you are with mysql injections, but with your setup it would be easy for a hacker to view your entire database!! And i am sure you don't want that to happen :) Am i right?

Have a nice day!!