Question

I have a form which has over 100 fields (most of which are checkboxes) and although not every field is always filled in, a large number will be. The thought of typing out each field to sanitise and construct the MySQL query is making me weep so I figure there must be a way to do this using a PHP loop.

I have managed to sanitise the form without writing out every element in the $_POST array and have it stored in $formarray in the form of $key=>$value. $key is not numerical or sequential and needs to be retained. The value of $key is the same as the column name in the database table that $value will be written to.

I want to be able to construct the MySQL query to insert the contents of $formarray into the MySQL table using a PHP loop. Is this possible?

Answer 1

It is possible, but not recommended, unless you are very careful. Making this loop approach secure may consume as much time as doing all the typing for all form fields, but your solution will be more roboust and modular.

You should create a mapping array wich contains directives on validating and formatting a certain value, something like this:

$validator = array(
    'user_name' => array('mask' => "'%s'", 'escape' => true,  'boolean' => false),
    'user_age'  => array('mask' => "%d",   'escape' => false, 'boolean' => false),
    'has_car'   => array('mask' => "%d",   'escape' => false, 'boolean' => true)
);

Then you iterate this validator array, and check if the key exists in your posted data, and apply the directives on the value, and collect all the SQL sets in a separate array:

$set = array();
foreach ($_POST as $key => $dirs)
{
    if ($dirs['boolean'])
    {
        $val = isset($_POST[$key]) ? 1 : 0;
        $set[] = sprintf("%s=".$dirs['mask'],$key,$val);
    }
    elseif (isset($_POST[$key]))
    {
        $val = $dirs['escape'] ? addslashes($_POST[$key]) : $_POST[$key];
        $set[] = sprintf("%s=".$dirs['mask'],$key,$val);
    }
}

After this you can create the query by imploding the set:

$sql = "INSERT INTO table SET ".implode(",",$set);

My approach above may not suite you actual needs, but is more of a concept you can use to handle large forms on server side. You can define more complex validatons, and make it handle arrays too, not just checkboxes and text fields like this example.

Always be on your guard, your form is the fornt door to your precious data, and if you go cheap, you’ll be sorry!