query("SELECT MAX(id) AS max_id FROM centers"); $max_id_row = $max_id_query->fetch_assoc(); $new_id_no = $max_id_row['max_id'] + 1; if ($_POST['status'] == 'insert') { $chk = $con->query("SELECT * FROM centers where email_id = '" . $_POST['email_id'] . "' AND contact_number = '" . $_POST['contact_number'] . "'"); if (!($chk->num_rows)) { $img = photo_upload('image', 'centers'); if ($img['status']) { // Escape all the values using mysqli_real_escape_string to prevent SQL injection $name = mysqli_real_escape_string($con, $_POST['name']); $institute_name = mysqli_real_escape_string($con, $_POST['institute_name']); $dob = mysqli_real_escape_string($con, $_POST['dob']); $pan_number = mysqli_real_escape_string($con, $_POST['pan_number']); $aadhar_number = mysqli_real_escape_string($con, $_POST['aadhar_number']); $center_full_address = mysqli_real_escape_string($con, $_POST['center_full_address']); $pincode = mysqli_real_escape_string($con, $_POST['pincode']); $whatsapp_number = mysqli_real_escape_string($con, $_POST['whatsapp_number']); $email_id = mysqli_real_escape_string($con, $_POST['email_id']); $qualification_of_center_head = mysqli_real_escape_string($con, $_POST['qualification_of_center_head']); $reception = mysqli_real_escape_string($con, $_POST['reception']); $username = mysqli_real_escape_string($con, $_POST['username']); $password = mysqli_real_escape_string($con, $_POST['password']); $query = "INSERT INTO `centers` (`id`, `timestamp`, `center_number`, `name`, `institute_name`, `dob`, `pan_number`, `aadhar_number`, `center_full_address`,`pincode`, `state_id`, `city_id`, `no_of_computer_operator`, `no_of_class_room`, `total_computer`, `space_of_computer_center`, `whatsapp_number`, `contact_number`, `email_id`, `qualification_of_center_head`, `staff_room`, `water_supply`, `toilet`, `reception`, `username`, `password`, `transection_id`, `status`, `image`) VALUES (NULL, CURRENT_TIMESTAMP, '".center_last_id()."', '$name', '$institute_name', '$dob', '$pan_number', '$aadhar_number', '$center_full_address','$pincode', '" . $_POST['state_id'] . "', '" . $_POST['city_id'] . "', '" . $_POST['no_of_computer_operator'] . "', '" . $_POST['no_of_class_room'] . "', '" . $_POST['total_computer'] . "', '" . $_POST['space_of_computer_center'] . "', '$whatsapp_number', '" . $_POST['contact_number'] . "', '$email_id', '$qualification_of_center_head', '" . $_POST['staff_room'] . "', '" . $_POST['water_supply'] . "', '" . $_POST['toilet'] . "', '$reception', '$username', '$password', '', '0', '$img[file_name]')"; $data = $con->query($query); if ($data) { echo ''; } else { die('Error: ' . $con->error . '
Query: ' . $query); } } else { echo ''; } } else { echo ''; } } ?>

FRANCHISE FORM