youys
/
cwe-top25

<?php
	// 1. Create a database connection
	$dbhost = "localhost";
	$dbuser = "root";
	$dbpass = "dakota02";
	$dbname = "UMUC";
	$connection = mysqli_connect($dbhost, $dbuser, $dbpass,
			$dbname);
//you could just place the variables directly into the arugments also, but
//it's easier to understand this way.

//Once we call the mysqli_connect function, the value that it returns is what we
//have assigned to the variable $connection. It is what is referred to as a handle for the connection.

//will see if connected, if not will quit and display error messages with error.
	//test if connection occured.
	if(mysqli_connect_errno()){
	die("Database connection failed: " .
		mysqli_connect_error() .
		"(" . mysqli_connect_errno() . ")"
	);
	}

?>
<?php

if (isset($_POST['submit'])){
//assign post data to variables
$first_name = $_POST["first_name"];
$last_name = $_POST["last_name"];
$student_id = $_POST["student_id"];
}

	//2. perform database query
	//This way is called assembling a query. Easier to read and work with.
	//could also wrap parts in if statements. ex. if something is true,
	//append the WHERE clause.
	$query = "INSERT INTO students (";
	$query .= " first_name, last_name, student_id"; 
	$query .= ") VALUES (";
	$query .= " '{$first_name}', '{$last_name}', '{$student_id}' ";
	$query .= ")";

	$result = mysqli_query($connection, $query);
	//test if there was a query error
	if($result){
			//success
			//could do a redirect. ex redirect to("somepage.php");
			echo "Success! Student added to database!";
			}else{		
			//failure	
			//$message = "Student creation failed";
			die("Database query failed. " . mysqli_error($connection));
			}
?>


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
	"http://www.w3.org/TR/html4/loose.dtd">
<html lang="en">

<head>
<title>SQL Injection</title>
</head>

<body>


</body>
</html>

<?php
	//5.close database connection
mysqli_close($connection);
?>