Need help deciphering PHP error message

Question

How to overcome from below error:

Notice: Use of undefined constant temp_members_db - assumed 'temp_members_db' 
in /var/www/signup_ac.php on line 10 Cannot send Confirmation link to 
your e-mail address

Below is the Code:

<?php

ini_set('display_errors',1);
error_reporting(E_ALL|E_STRICT);

include('config.php');

// table name
$tbl_name=temp_members_db;

// Random confirmation code
$confirm_code=md5(uniqid(rand()));

// values sent from form
$name=$_POST['name'];
$email=$_POST['email'];
$country=$_POST['country'];

// Insert data into database
$sql="INSERT INTO $tbl_name(confirm_code, name, email, password, country)VALUES('$confirm_code', '$name', '$email', '$password', '$country')";
$result=mysql_query($sql);

// if suceesfully inserted data into database, send confirmation link to email
if($result){

// ---------------- SEND MAIL FORM ----------------

// send e-mail to ...
$to=$email;

// Your subject
$subject="Your confirmation link here";

// From
$header="from: your name <your email>";

// Your message
$message="Your Comfirmation link \r\n";
$message.="Click on this link to activate your account \r\n";
//$message.="http://www.yourweb.com/confirmation.php?passkey=$confirm_code";
$message.="http://localhost/confirmation.php?passkey=$confirm_code";

// send email   
$sentmail = mail($to,$subject,$message,$header);

}

// if not found
else {
echo "Not found your email in our database";
}

// if your email succesfully sent
if($sentmail){
echo "Your Confirmation link Has Been Sent To Your Email Address.";
}
else {
echo "Cannot send Confirmation link to your e-mail address";
}

?>

Answer 1

Either you forgot a $ or you forgot some quotes.

Answer 2

You are probably using temp_members_db as an array key but didn’t quote the string properly:

$arr[temp_members_db] ⟶ $arr['temp_members_db']

See also Why is $foo[bar] wrong?:

This is wrong, but it works. The reason is that this code has an undefined constant (bar) rather than a string ('bar' - notice the quotes). PHP may in future define constants which, unfortunately for such code, have the same name. It works because PHP automatically converts a bare string (an unquoted string which does not correspond to any known symbol) into a string which contains the bare string. For instance, if there is no defined constant named bar, then PHP will substitute in the string 'bar' and use that.

Answer 3

Is it me, or there is a huge SQL-injection and Mail-injection in this code ?

(And it is not just some fancy words, it means you not fully understand what you are doing...)

And by the way PHP6 is not arrived yet, so function get_magic_quotes_gpc() is still exists, and it is still necessary ...

Answer 4

<?php

ini_set('display_errors',1);
error_reporting(E_ALL|E_STRICT);

include('config.php');

// table name
$tbl_name=temp_members_db;

You're either missing quotes:

$tbl_name='temp_members_db';

or the constant definition:

define('temp_members_d', 'whatever');