Question

I am trying to take the entire post array and put each value into a select statement that will update the previous value. I am having trouble doing this in php with string escaping.

This is the SQL statement I am trying to pass:

UPDATE test1l.testtable SET age=106, weight=345, WHERE id=11

So the submission page first puts the $_POST array into a variable. Then I try to set the statement up so that each post variable is in the right place.

$dataArray = $_POST;
$Sql =" UPDATE test1l.testtable SET age=$dataArray['age'],weight=$dataArray['weight'] WHERE id=$dataArray['id']"

The single and double quotes are messing my statement up. Also, I have a custom function that is character escaping these strings so as to help stop injection.

Answer 1

Use concatenation :

'update ... SET age = ' . $dataArray['age'] . ', weight = ...'

And make sure to validate and properly escape your post attributes to avoid SQL injection. Or even better: use prepared statements to be sure. See http://php.net/manual/fr/mysqli.prepare.php