Is this code right?

[unknowngiver]

Hey
is this code right to add stuff into a database?
its not working i think

<form action="<?$_self?>" method="post">
<input type="text" name="author" value="Author">
<textarea name="story">
Story here
</textarea>
<input type="text" name="email" value="AuthorEmail">
<input type="submit" value="Submit"></form>
<?php
$author= $_POST['author'];
$story= $_POST['story'];
$authoremail= $_POST['AuthorEmail'];
$username="fu2_story";
$password="story";
$database="fu2_stories";

mysql_connect(localhost,$username,$password);

@mysql_select_db($database) or die( "Unable to select database");


$query = 'INSERT INTO `main` (`author`, `story`, `author_email`) VALUES (\'$author\', \'$story\', \'$authoremail\')';
mysql_query($query);
?>

 

[Eric]

//As for the PHP bit

<?php

$author = $_POST['author'];
$story = $_POST['story'];
$authoremail = $_POST['AuthorEmail'];
$username = "fu2_story";
$password = "story";
$database = "fu2_stories";

$db = mysql_connect("localhost", $username, $password) or die("Unable to connect.");
@mysql_select_db($database, $db) or die("Unable to select database");

$query = mysql_query("INSERT INTO main (author, story, author_email) VALUES ('$author', '$story', '$authoremail')") or die("Could not insert data into database<br>".mysql_error());

?>

 

[stscac]

<form action="<?=$_SERVER['PHP_SELF'];?>" method="post">
<input type="text" name="author" value="Author">
<textarea name="story">
Story here
</textarea>
<input type="text" name="email" value="AuthorEmail">
<input type="submit" value="Submit"></form>
<?php
$author= $_POST['author'];
$story= $_POST['story'];
$authoremail= $_POST['AuthorEmail'];
$username="fu2_story";
$password="story";
$database="fu2_stories";

mysql_connect(localhost,$username,$password);

@mysql_select_db($database) or die( "Unable to select database");


$query = "INSERT INTO `main` (`author`, `story`, `author_email`) VALUES ('$author', '$story', '$authoremail')";
mysql_query($query);
?>

If you're going to be inserting something from a form on a page, you are going to want to sanatize it. Use addslashes like the following:

$author = addslashes($_POST['author']);

I'll be posting some php tutorials for things like this on my site. I also wrote a database class called SMyCC that will help you connect to databases by using a single line of code.

-Steve