RE: [PHP] i'm beginner and i couldn't solve the problem
| From: | Chris W. Parker | Date: | Wed, 08 Dec 2004 16:58:06 +0000 |
| Subject: | RE: [PHP] i'm beginner and i couldn't solve the problem | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-203737@lists.php.net to get a copy of this message | ||
Ford, Mike <mailto:M.Ford@leedsmet.ac.uk>
on Wednesday, December 08, 2004 5:18 AM said:
>> $sql = "INSERT INTO testTable values ('',
>> '$_POST[testField]')";
>>
>> should be
>>
>> $var = $_POST["testField"];
>> $sql = "INSERT INTO testTable values ('', '$var')";
>
> Nope -- the original is functionally identical to your suggested
> correction.
Hmm... I thought arrays don't work correctly within a string unless they
are wrapped with { and }?
<?php
$sql = "INSERT INTO ... ('', '{$_POST['testField']}')";
?>
Also you should always wrap the index name in single quotes (or maybe
double quotes work also.)
Chris.
p.s. It's a bad idea to directly insert data from outside your script
into your database. Check the recent PHP Security thread for more info.