Declaring and initializing variables programatically in php [closed]

Question

Closed. This question needs details or clarity. It is not currently accepting answers.

Want to improve this question? As written, this question is lacking some of the information it needs to be answered. If the author adds details in comments, consider editing them into the question. Once there's sufficient detail to answer, vote to reopen the question.

Closed 11 years ago.

Improve this question

I am sure there is a much better way to do this, I am just unaware of how to do it. Basically I am submitting a form to a page that will grab the info and stuff it into a MYSQL database. Currently I have it set up so I declare the variable and set its value from the _POST, and then later add it to the correct MYSQL column. Here is a snippet:

$k1 = $_POST['k1'];
$k2 = $_POST['k2'];
$k3 = $_POST['k3'];
...

$sql = "INSERT INTO patches (k1, k2, k3, ...) VALUES ('$k1', '$k2', 'k3', ... )";

Obviously this is a hassle with a large amount of fields. What steps could I take to improve this? Thanks!

you can make a string by for loop and then insert to mysql string — Ammar Hayder Khan
– Ammar Hayder Khan, Commented Jan 1, 2014 at 9:02
Why do this in the first place? Just leave the data in an array. — deceze
– deceze ♦, Commented Jan 1, 2014 at 9:03

Austin Brunkhorst · Accepted Answer · 2014-01-01 09:27:34Z

2

Assuming that every single post field is a table column, you can do something like this.

$keys = implode(',', array_keys($_POST));

$values = implode(',', array_map(function($value) {
    return "'". addslashes($value) ."'";
}, array_values($_POST)));

$sql = "INSERT INTO patches ($keys) VALUES ($values)";

Unfortunately, this is method would be very vulnerable to SQL injection. A better method is a similar approach, but preparing a statement and binding the values using PDO.

$keys = implode(',', array_keys($_POST));
$params = implode(',', array_fill(0, count($_POST), '?'));

$sql = $dbHandle->prepare("INSERT INTO patches ($keys) VALUES ($params)");

$sql->execute(array_values($_POST));

Where $dbHandle is a PDO connection resource. You can find more information about PDO here.

edited Jan 1, 2014 at 9:27

answered Jan 1, 2014 at 9:15

Austin Brunkhorst

21.1k6 gold badges49 silver badges61 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Community · Accepted Answer · 2017-05-23 12:28:41Z

2

Using [] in the input element's name attribute like so:

<input name="k[]" type="text">
<input name="k[]" type="text">
<input name="k[]" type="text">

will return an array on the PHP end:

$k = $_POST['k'];

and you can use implode() to format those values for SQL:

$sql = "INSERT INTO patches (k1, k2, k3, ...) VALUES ('".implode("','", $k)."');";

-source code by User Pekka, found here.-

edited May 23, 2017 at 12:28

CommunityBot

11 silver badge

answered Jan 1, 2014 at 9:16

Skurhse Rage

1,0201 gold badge9 silver badges28 bronze badges

2 Comments

Austin Brunkhorst Over a year ago

The problem with this is that the values have no associativity. This is assuming that the order the values were sent in the post header are respective to the order of columns in each row.

Skurhse Rage Over a year ago

@AustinBrunkhorst A fair point. I would argue that associativity is indeed established in the insert statement, though without modularity.

Mark · Accepted Answer · 2014-01-01 09:27:51Z

1

// you should not work with the $_POST array itself, but rather extract values from it
$foo = array('k1' => 1, 'k2' => 2, 'k3' => 3);
$keys = array_keys($foo);
$sql  = 'INSERT INTO patches';
$sql .= '(' . implode(',', $keys) . ')';
array_walk($keys, function(&$val){
    $val = ":$val";
});
$sql .= 'VALUES (' . $keys . ')';

And then you can call your query as such:

$query = $pdo->prepare($foo);
$query->execute($foo);

edited Jan 1, 2014 at 9:27

answered Jan 1, 2014 at 9:12

Mark

1,3979 silver badges18 bronze badges

Comments

RaviRokkam · Accepted Answer · 2014-01-01 09:42:18Z

0

$_POST["k1"] = "1";
$_POST["k2"] = "2";
$_POST["k3"] = "3";
$_POST["k4"] = "4";
$_POST["k5"] = "5";
$_POST["k6"] = "6";

$str_keys = "";
$str_val = "";
foreach ($_POST as $key => $val) {
        $str_keys .= ($str_keys) ? ",".$key : $key;

        $str_val .= ($str_val) ? ",'".$val."'" : "'".$val."'";
}
$sql = "INSERT INTO patches (".$str_keys.") 
        VALUES (".$str_val.")";

echo $sql ;

Formed query

INSERT INTO patches (k1,k2,k3,k4,k5,k6) VALUES ('1','2','3','4','5','6')

answered Jan 1, 2014 at 9:42

RaviRokkam

7899 silver badges16 bronze badges

Collectives™ on Stack Overflow

Declaring and initializing variables programatically in php [closed]

4 Answers 4

Comments

2 Comments

Comments

Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

2 Comments

Comments

Comments

Linked

Related