Question

Scenario: I have an insert .php file to insert into applicant table: (columns: firstname, lastname and class) from a PHP form I created. However there is a third column that is hard coded in the php file: class.

mysql_query("INSERT INTO applicant(firstname, lastname, class)
VALUES ('$_POST[firstname]','$_POST[lastname]','Computer');

From time to time I may want to change the value from computer. Is there a way for me to change it without having to open the PHP file? For example, can I change it by entering a value into an HTML form?

Answer 1

At the risk of going too deep too fast I would extend the class you don’t want to use EG: the class that says:

    mysql_query("INSERT INTO applicant(firstname, lastname, class) VALUES ('$_POST[firstname]','$_POST[lastname]','Computer');

Could be extended to be a class where the 3rd value is a parameter or a preset value for the new class.

Also I would alter the un-extended class to look like this to avoid INJECTION attacks

  mysql_query("INSERT INTO applicant(firstname, lastname, class) VALUES ('".mysql_real_escape_string($_POST[firstname])."','".mysql_real_escape_string($_POST[lastname])."','Computer');