Question

I have created a new database table with the name ‘table’. Now i’m trying the following code to write the data into the fields:

if (isset ($_POST['request'])) {

$F1 = $_POST['F1'];
$F2 = $_POST['F2'];
$F3 = $_POST['F3'];
$F4 = $_POST['F4'];

$sql_data_array = array('F1' => zen_db_prepare_input($_POST['F1']),
'F2' => zen_db_prepare_input($_POST['F2']));

zen_db_perform('table', $sql_data_array);

$db->Execute("insert into requests (F1, F2, F3, F4) values ('".$F1."', '"$F2."', '".$F3."', '".$F4. "')");
}

When i press the submit button i get blank page. It means something wrong with my code.
Where is the mistake? Please help me out.

Answer 1

A couple of things:

1. Don’t just take the posted values; do some cleanup on them to ensure you won’t get hacked.

   $F1 = zen_db_prepare_input(zen_sanitize_string($_POST['F1'])); 
   

2. “table” is really not a great name for a table. It’s probably a reserved word, so you really want to call it (say) “fawad_table”.
   If you then do this:

   zen_db_perform('fawad_table', $sql_data_array);
   

   it will ONLY work if you don’t use a prefix in your configure.php file. If you do this will fail. The better thing is to create

   ./includes/extra_datafiles/special_tables.php
   

   which does something like

   define('TABLE_FAWAD', DB_PREFIX . 'fawad_table');
   

   then you can use

   zen_db_perform(TABLE_FAWAD, $sql_data_array);
   

and it will work with or without a prefix.