Question

Hi I’m really new to php/mysql.

I’m working on a php/mysql school project with 39 fields all in all in a single table.
I want to shorten my codes especially on doing sql queries.

$sql = "INSERT into mytable ('field_1',...'field_39') Values('{$_POST['textfield_1']}',...'{$_POST['textfield_39']}')";

I don’t know how to figure out this but , i want something like:

$sql = "Insert into mytable ("----all fields generated via loop/array----")  Values("----all form elements genrated via loop/array---")";

Thank you in advance.

Answer 1

You could use implode:

$sql = "
INSERT into mytable 
('" . implode("', '", array_keys($_POST) . "') 
VALUES
('" . implode("', '", $_POST . "')";

(This assumes the indices of the POST array are also the names of the db table fields)

However, this is extremely insecure since you would directly insert post data into the database.

So the least you should do beforehand is escape the values and make sure they are ok/valid table fields:

// Apply mysql_real_escape_string to every POST value
array_walk($_POST, "mysql_real_escape_string");

and

// Filter out all POST values with invalid indices
$allowed_fields = array('field_1', 'field_2', /* ... */ );
$_POST = array_intersect_key($_POST, $allowed_fields);