Question

I’m trying to do something like this so I don’t have to type out all of my post entries. I can’t seems to get this to work though.

edit: added some changes.

foreach($_POST as $key => $value) 
{
    $key = "'".mysql_real_escape_string($key)."'";  
    $value = "'".mysql_real_escape_string($value)."'";
    $qstring = "UPDATE load_test SET ".$key."=".$value." WHERE Id = '".$_POST['id']."'";  
        mysql_query($qstring);
}  

Answer 1

foreach($_POST as $k=>$v){
        @$select.=" `".mysql_real_escape_string($k)."` = '".mysql_real_escape_string($v)."',";
}
$select = rtrim($select,',');
$select = "UPDATE load_test SET".$select." WHERE id=".$_POST['id'];
mysql_query($select) or die(mysql_error());;

try this is alot faster then the previous one you want need to do more then 1 query
and other then that i think it’s safe enough to escape the key since trying updating a column that doesn’t exist doesn’t get you anywhere, and trying to make an injection escaping will protect you from that, you should though make sure the id is numeric