This question already has an answer here:
The Code wen i send a call to my script like this http://www.mywebsite.com/savedata.php?user_id=abc
and this is my code
<?php
header('Access-Control-Allow-Origin: *');
error_reporting(E_ALL);
ini_set('display_errors',1);
$servername = "localhost";
$username = "user_name";
$password = "pass";
try {
$conn = new PDO("mysql:host=$servername;dbname=mydb_name", $username, $password);
// set the PDO error mode to exception
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
echo "Connected successfully";
}
catch(PDOException $e){
echo "Connection failed: " . $e->getMessage();
}
if(isset($_GET['user_id'])){
//$user_id = intval($_GET['user_id']);
//Lightly sanitize the GET's to prevent SQL injections and possible XSS attacks
try {
$dbh = new PDO("mysql:host=$servername;dbname=db_name", $username, $password);
$user_id = @$_GET['user_id'];
$dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); // <== add this line
$sql = "INSERT INTO users (user_id) VALUES ('".$_POST["user_id"]."')";
if ($dbh->query($sql)) {
echo "<script type= 'text/javascript'>alert('New Record Inserted Successfully');</script>";
}
else{
echo "<script type= 'text/javascript'>alert('Data not successfully Inserted.');</script>";
}
$dbh = null;
}
catch(PDOException $e){
echo $e->getMessage();
}
}
?>
$sql->execute(array($user_Id));
if($sql){
//The query returned true - now do whatever you like here.
echo 'Your ID was saved. Congrats!';
}else{
//The query returned false - you might want to put some sort of error reporting here. Even logging the error to a text file is fine.
echo 'There was a problem saving your points. Please try again later.';
}
}else{
echo 'Your id wasnt passed in the request.';
}
// close MySQL connection
$conn = null;
?>
<html>
<head>
</head>
<body>
<body bgcolor="#ffffff">
</body>
</html>
</div>
You check for $_GET['user_id']...
if(isset($_GET['user_id'])){
...but then you try to access $_POST['user_id']:
$sql = "INSERT INTO users (user_id) VALUES ('".$_POST["user_id"]."')";
P.S.: in the query you can simply use $user_id, given that some line before you do:
$user_id = @$_GET['user_id'];
You sometimes use $_GET["user_id"], but sometimes $_POST["user_id"]. If you are always sending data through GET you should always use $_GET["user_id"].
Or simply use $_REQUEST["user_id"].