Question

I have a number of textareas, each with a unique assigned name (name=”adcode$ID”, for example). When I try to pass those names to the code below, it doesn’t work because of the dynamic part.

if (isset($_POST['editadapp'])) {  // Edit AD
$newadcode = mysql_real_escape_string($_POST['.adcode$ID.']);
$doedit = "UPDATE ads SET adcode = '".$newadcode."') WHERE ads_ID=$ID" or die(mysql_error());
$updatead = mysql_query($doedit) or die(mysql_error());
    header("Location: " . $_SERVER['PHP_SELF']);

How can I resolve this?

Answer 1

There is so much wrong with this that it’s frightening.

Firstly,

$doedit = "UPDATE ads SET adcode = '".$newadcode."') WHERE ads_ID=$ID" or die(mysql_error());

That code snippet is wrong on many levels.

1. The sql syntax is wrong
2. The sql is formatted with strings from user input (see parameterization of queries here
3. or die() should not be used here, you’re creating a string

Ideally you should have code like:

$dbh =  new PDO('connectionstring to connect to your database');
$sql = 'update ads set adcode = ? where ads_id = ?';
$sth = $dbh->prepare($sql);
$sth->execute(array($_POST['adcode' . $ID], $ID));

Other topics:

Are Paramerterized queries necessary in pdo?

prepared queries with pdo

Preventing sql injection in php