PHP mySQL preg_replace string & store result -

so after bringing code strip button id paypal form code, i'm faced difficulty of getting information stored in database.

the paypal code of course this:

<form target="paypal" action="https://www.paypal.com/cgi-bin/webscr" method="post"> <input type="hidden" name="cmd" value="_s-xclick"> <input type="hidden" name="hosted_button_id" value="a58f6b5hvxebu"> <input type="image" src="https://www.paypalobjects.com/en_us/i/btn/btn_cart_lg.gif" border="0" name="submit" alt="paypal - safer, easier way pay online!"> <img alt="" border="0" src="https://www.paypalobjects.com/en_us/i/scr/pixel.gif" width="1" height="1"> </form> 

with following code, value a58f6b5hvxebu removed of above:

<?php $string = ''; $res = preg_replace('~(.+)(name="hosted_button_id"\s+value=")([^"]+)(["].+)~s', '$3', $string); ?> 

i know above code needs go action.php file handles form information , adds database i'm not sure how arrange it. can't seem work way try. believe name on form have different database row what's in textarea can processed through preg_replace code sent database i'm stuck on 1 stinks because i'm sure it's simple lol

the setup form , processing file this:

<form action="action.php" method="post" name="addclass"> <table> <tr> <td><strong>paypal code: </strong></td> <td><textarea name="paypal" rows="4" cols="50"></textarea></td> </tr> </table> <input type="submit" name="submit" value="submit"> </form> 

action.php add database:

<?php $con=mysqli_connect("root","username","pass","dbname"); // check connection if (mysqli_connect_errno()) { echo "failed connect mysql: " . mysqli_connect_error(); }  $sql="insert tester (paypal) values ('$_post[paypal]')";  if (!mysqli_query($con,$sql)) { die('error: ' . mysqli_error($con)); } echo "<center><h1>1 class added</h1>"; echo "<br /><br /><a href=view.php><font size=18>back list</font></a>"; mysqli_close($con); ?> 

i have been racking brain trying different ways of implementing preg_replace code action.php file save 13-character value string database , each way it, form processes , says record has been added creates blank record , doesn't store database.

you missed quotations on key name of post variable in query. not sanitizing data, , not using prepared statements, script, despite using mysqli still insecure. use mysqli_stmt_prepare() queries contain $variables or other input. use mysqli_query() queries don't require user submitted data or script variables.

$sql="insert tester (paypal) values ('".$_post['paypal']."')";