Question

am trying to fetch some data from a form, but i cant for some reason.
here are some lines of my code.

cellphone: <input type = "text" name = "cellphone"><br />
username : <input type = "text" name = "username"><br />

    $cellphone = $_GET["cellphone"];
    //$cellphone = int() $cellphone;
    $username= $_GET["username"];

$link = mysql_connect('myhost', 'myuser', 'mypass') or die("could not connect to database");
    mysql_select_db ('hunter',$link) or die ("could not find database");
    echo "fetced database";
    //injecting user info into database
    mysql_query("INSERT INTO player values ('','$firstname','$lastname','$location','$cellphone','$username','$email','$password')")or die("could not inject into database.");

but i can not get the cell number to get into my database for some reason.
please help me 😀

Answer 1

FIRST:
you should must sanitize all incoming variables!

then, to cast to an integer, you can use:

$cellphone = (int) $_GET["cellphone"];

A better solution is to use filter_var();

$cellphone = filter_var( $_GET["cellphone"], FILTER_VALIDATE_INT);

You should read about input validation/sanitazion and filter_var before writing any further code.

now, before people start to advice mysql_real_escape_string() (which does the job, but is not the best solution), take a look at prepared statements through either PDO or MySQLi