Form Not Being Passed On Server

Question

I have a registration form on my website which passes the inputs through JQuery Post and into a PHP file. This all works fine on my localhost which runs PHP 5.2, but when I upload it to my server (5.4) I'm getting problems with the form not being processed.

Here is the code I'm using:

$time = time();
$id= time().'-'.mt_rand(100000000, 999999999);
$type= mysqli_real_escape_string($con, $_REQUEST["type"]);
$subtype= mysqli_real_escape_string($con, $_REQUEST["subtype"]);
$name= mysqli_real_escape_string($con, $_REQUEST["name"]);
$name = ucwords(strtolower($name));
$email= mysqli_real_escape_string($con, $_REQUEST["email"]);
$relative= mysqli_real_escape_string($con, $_REQUEST["relative"]);
$relative = ucwords(strtolower($relative));
$summary= mysqli_real_escape_string($con, $_REQUEST["bio"]);
$postcode= mysqli_real_escape_string($con, $_REQUEST["postcode"]);
$sendpassword= mysqli_real_escape_string($con, $_REQUEST["password"]);
$password= md5(mysqli_real_escape_string($con, $_REQUEST["password"]));
$hash = md5( rand(0,1000) );

Answer 1

Firstly, looking at your code, you are using mysqli_real_escape_string() to do your input sanitization. This is not a great idea, as it will fail to run and throw an error if you do not have an active mysqli connection to a MySQL database.

Secondly, take a look at the PHP error log on your server. That should give you a clue as to what is going wrong. If you do not have an error log setup, or don't know where it is, then take a look in the php.ini configuration file (on linux this is located normally at /etc/php/apache2/php.ini - something like that) and search for the line that looks like:

error_log = <something>

If there is a semicolon (;) in front of that line, then remove it. This line/directive sets the location to which PHP writes error messages. You can set this to whatever you want, and then remember to restart your webserver to apply the change.

Then try running your PHP code again, and then look in the file you specified as the error_log to see what is going wrong. My guess would be that it has to do with the mysqli_real_escape_string().

I hope that is helpful.

Regards, Ralfe