converting text to int from a form

Question

am trying to fetch some data from a form, but i cant for some reason. here are some lines of my code.

cellphone: <input type = "text" name = "cellphone"><br />
username : <input type = "text" name = "username"><br />

    $cellphone = $_GET["cellphone"];
    //$cellphone = int() $cellphone;
    $username= $_GET["username"];

$link = mysql_connect('myhost', 'myuser', 'mypass') or die("could not connect to database");
    mysql_select_db ('hunter',$link) or die ("could not find database");
    echo "fetced database";
    //injecting user info into database
    mysql_query("INSERT INTO player values ('','$firstname','$lastname','$location','$cellphone','$username','$email','$password')")or die("could not inject into database.");

but i can not get the cell number to get into my database for some reason. please help me :D

IMHO a cellphone number should not be stored as an int, semantically it is not an integer but a numeric ID. — Caspar Kleijne
– Caspar Kleijne, Commented Sep 8, 2010 at 8:01

Jacco · Accepted Answer · 2010-09-08 08:14:25Z

3

FIRST:
you ~~should~~ must sanitize all incoming variables!

then, to cast to an integer, you can use:

$cellphone = (int) $_GET["cellphone"];

A better solution is to use filter_var();

$cellphone = filter_var( $_GET["cellphone"], FILTER_VALIDATE_INT);

You should read about input validation/sanitazion and filter_var before writing any further code.

now, before people start to advice mysql_real_escape_string() (which does the job, but is not the best solution), take a look at prepared statements through either PDO or MySQLi

edited Sep 8, 2010 at 8:14

answered Sep 8, 2010 at 7:43

Jacco

23.9k18 gold badges92 silver badges106 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Your Common Sense Over a year ago

mysql_real_escape_string() don't do the job. mysql_real_escape_string() plus quotes does. and it shouldn't be only "input validation", but query building rule

Jacco Over a year ago

@Col. Shrapnel, True; if it is a string, you need quotes. And yes, escaping strings should be part of your query building process. This however is an answer to a beginners question, so I try persuade the OP to a) read more and learn, and b) use a proven library with prepared statements and let it handle a lot of the complex work for them.

Your Common Sense · Accepted Answer · 2010-09-08 08:32:13Z

2

make your form POST method, not GET. GET is for requestig data and POST for storing.
Consider to use varchar type field for the phone number.
Though it would be a very good idea to normalize a phone number before insert, by stripping all non-numeric characters from it.

answered Sep 8, 2010 at 8:32

Your Common Sense

158k42 gold badges226 silver badges373 bronze badges

Comments

drAlberT · Accepted Answer · 2010-09-08 07:48:41Z

1

Replace die("msg") with die(mysql_error()) in order to debug the reason of the failure
Don't insert user provided data directly into the DB, use mysql_real_escape_string() or similar to sanitize the data and protect against SQL injections
if the problem is that you phone field is declared as int into the DB, then assure it is an integer before performing the insert. You can try to cast to int, but I think you should perform some more accurate sanitization on the data, checking the expected "admitted" format and type for each field and returning a per field error to the user in case of mis-insertion

By the way, if you store a phone number as an integer you cant handle very well the international prefix (+39 or 0039 for Italy for example), as "+" is not a number, and "00" would be lost in the cast to integer ....

answered Sep 8, 2010 at 7:48

drAlberT

23.5k5 gold badges37 silver badges41 bronze badges

1 Comment

Your Common Sense Over a year ago

mysql_real_escape_string() do not sanitize anything!

yretuta · Accepted Answer · 2010-09-08 07:53:07Z

1

this may be that your mysql column only accepts INT but input is alphanumeric. in this case, you may use $cellphone = filter_var($_GET['cellphone'], FILTER_SANITIZE_NUMBER_INT);if you are expecting an integer-only input

answered Sep 8, 2010 at 7:53

yretuta

8,14118 gold badges85 silver badges155 bronze badges

Collectives™ on Stack Overflow

converting text to int from a form

4 Answers 4

2 Comments

Comments

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

2 Comments

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related