0

I have an array containing the names of form input names:

$minmax = array('bed_min', 'bed_max', 'rec_min', 'rec_max', 'bath_min', 'bath_max', 'value_min', 'value_max');

The names are identical to the corresponding columns in a database. Instead of using an sql query like so:

$bed_min=$_POST['bed_min'];
$bed_max=$_POST['bed_max'];
$rec_min=$_POST['rec_min'];
$rec_max=$_POST['rec_max'];
$bath_min=$_POST['bath_min'];
$bath_max=$_POST['bath_max'];
$value_min=$_POST['value_min'];
$value_max=$_POST['value_max'];


$query = "UPDATE first_page SET bed_min='$bed_min', bed_max='$bed_max', rec_min='$rec_min', rec_max='$rec_max', bath_min='$bath_min', bath_max='$bath_max', value_min='$value_min', value_max='$value_max', WHERE email_address='$email' ";

Is there a way to automate all this into a smaller lump of code? I know the POST values should not be added to the query diectly, so maybe a loop to assign the POST values to a corresponding array of variables using something like:

foreach ($minmax as $var){
  $var = $_POST[$var]
}

(nb i dont think this snippet will work but ive added it because I think with a bit of editing it might!)

After the list of variables have been assigned the POST values, do the update in the $query using two arrays, one with the list of values and one with the list of database columns. Again I dont know how this will work, so pointers would be helpful!

3
  • 1
    Dat unsanitized query tho... Mar 4, 2014 at 21:52
  • Look into prepared queries, us1.php.net/pdo.prepared-statements
    – Chitowns24
    Mar 4, 2014 at 21:55
  • yea forgot to mention, ignore sanitization - im getting the nuts and bolts working before adding that! (also trying my hardest to migrate from MYSQL to PDO....)
    – Giovanni
    Mar 4, 2014 at 21:55

3 Answers 3

1

You don't really need the $minmax array of form input names since you can get those from the keys of $_POST.

If the values are all numbers, like they seem to be, then you could do it all in one line like this:

$query = "UPDATE first_page SET " . vsprintf(implode("='%d', ", array_keys($sanitized_POST))."='%d'", array_values($sanitized_POST))." WHERE email_address='$email'";

That's assuming you have already sanitized the items from $_POST into a new array named $sanitized_POST. I know you said in the above comment to ignore sanitization, but I thought I'd add it so you know I'm not suggesting to use the values straight from $_POST.

You could sanitize the $_POST array with something like this:

$sanitized_POST = array_map(function($item) {

    return mysqli::real_escape_string($item);

}, $_POST);

Honestly though, you should try to come up with a solution that uses prepared statements.

On a side note, if you have the sanitized post array, then this one line will essentially do what Quixrick has done with variable variables in one of the other answers:

extract($sanitized_POST);
0

If you assume that all of the values in post have the same names (array keys) as your columns, then something like this could work for you:

$query = "UPDATE first_page SET ";
foreach ($_POST as $key => $var){
  $query .= " $key='$var',";
}
$query = rtrim($query,',') . " WHERE email_address='$email' ";
0

You probably want to use 'Variable Variables' here. Basically, you'd use a double dollar sign $$ to create a variable with the name of the array value.

$_POST['bed_min'] = 'Rick';

$minmax = array('bed_min', 'bed_max', 'rec_min', 'rec_max', 'bath_min', 'bath_max', 'value_min', 'value_max');


foreach ($minmax as $var){
    $$var = $_POST[$var];
}

print "<BR>BED MIN: ".$bed_min;

This outputs:

BED MIN: Rick

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.