There is a property of the mysqli object called $insert_id
that will return you the id
of the newly inserted row if the id
column is an AutoIncrement column.
<?php
session_start();
//database configuratie file
require('dbconfig.php');
// process first query
$sql = "INSERT INTO `tickets`
(`naam`, `onderwerp`, `maker`) VALUES (?,?,?)";
$stmt = $mysqli->prepare($sql);
$stmt->bind_param('sss', $_POST['ticket_naam'],
$_POST['ticket_onderwerp'],
$_SESSION['username']);
$stmt->execute();
// retrieves the generated new id from the query above
$new_id = $mysqli->insert_id;
// inserts the id into another query
$sql = "INSERT INTO `berichten`
(`id`, `text`, `voornaam`,`achternaam`,`firma`)
VALUES (?,?,?,?,?)";
$stmt = $mysqli->prepare($sql);
$stmt->bind_param('isss', $new_id,
$_POST['bericht'],
$_SESSION['voornaam'],
$_SESSION['achternaam'],
$_SESSION['firma']);
$res = $stmt->execute();
if ($res) {
require('email_na_ticketaanmaak.php')
require('../procces_files/email_na_ticketaanmaak.php');
header('Location: ../home/index.php');
}else{
echo "Error: " . $sql . "<br>" . $mysqli->error;
}
?>
If you are going to redirect to another page using
header('Location: ../home/index.php');
there is no point sending this back to the page you were on, as you will never see it.
<script>alert('nieuw ticket is gemaakt');</script>
Also Your script was open to SQL Injection Attack.
Even if you are escaping inputs, its not safe!
You should consider using prepared parameterized statements in either theMYSQLI_
orPDO
API’s instead of concatenated values
So I changed the code a little to use parameterised, prepared and bound queries.