Question

So its simple, I need to replace the number 1 with 2 then 3 and so on 32 times. I know how to create simple PHP loops and everything but want to leave this “Clean” so its easier for you guys to help me.

Thank you for any help you can provide me.

<?php
  $con = mysql_connect("localhost","user","pass");
  if (!$con)
    {
    die('Could not connect: ' . mysql_error());
    }

  mysql_select_db("mbbcom1_rfhl", $con);

  $sql="UPDATE `mbbcom1_rfhl`.`_statbu`
  SET gp= gp + '$_POST[gp1]', g= g + '$_POST[g1]', a= a + '$_POST[a1]', shot= shot + '$_POST[s1]', pm= pm + '$_POST[pm1]', ppg= ppg + '$_POST[ppg1]', shg= shg + '$_POST[shg1]', bs= bs + '$_POST[blk1]', gwg= gwg + '$_POST[gwg1]', sog= sog + '$_POST[sog1]', soa= soa + '$_POST[soa1]', pim= pim + '$_POST[pim1]' WHERE `season` =9 AND `_statbu`.`player_id` = 1";
  if (!mysql_query($sql,$con))
    {
    die('Error: ' . mysql_error());
    }
  mysql_close($con)
  ?>

So just to be clear, i need the next loop to do the same thing but with ‘$_POST[gp2]’, g= g + ‘$_POST[g2]’ ….ect

Once again, thank you

Answer 1

Wow, you need to look up SQL INJECTION. This code is NOT, NOT, NOT safe. You need to, at a bare minimum mysql_real_escape_string() on all of that posted data (example below).

As to how to loop. If this is all updating the same table and you :

//do your connection and db select here
for( $i=1; $i <= 32; $i++ ) {
    $sql = "gp='".mysql_real_escape_string($_POST["gp{$i}"])."'...
    //mysql_query() here
}
//mysql_close() here

You only wnat to die() on mysql_query if you want one query failing to break the other 31 or however many are left. Otherwise you can fail more gracefully and just ignore it, but leave yourself a message.

You might also want to look into PDO if you have it available as it’s a bit simpler to use.