2

I have a PHP function that makes a query to MySQL DB.

function regEvent($event, $l)
{
$sqlz_upd="UPDATE {$event} SET f1a='$_POST[F1A"'.$l.'"]'";

The question is what is the syntax to use variable $l in $_POST[F1A$l]?

1
  • 3
    Side note: Read up on SQL injection Commented Oct 5, 2011 at 13:37

3 Answers 3

4
$condition = $_POST["F1A" . $l];
$sqlz_upd="UPDATE {$event} SET f1a='".mysql_real_escape_string($condition)."'";

This is how to use your dynamic post and be safe for Sql Injection.

2
  • 1
    This wil definitly do the tric! Commented Oct 5, 2011 at 13:52
  • Even better would be to look into PHPs PDO. Commented Oct 5, 2011 at 13:56
1

Here you go:

$var = mysql_real_escape_string($_POST["F1A".$l]);
$sqlz_upd="UPDATE {$event} SET f1a='$var' ";
1
  • 3
    I'm not downvoting, but note that answering with code with injection vulnerabilitles is regarded downvote-worthy by many! (myself included usually.) Commented Oct 5, 2011 at 13:46
1

if you are using a string as key in an associative array. It should be enclosed in single or double quotes(though PHP won't give any error).

i.e. $_POST['F1A'. $l] or $_POST["F1A$l"]

my suggestion will be...

$sqlz_upd="UPDATE {$event} SET f1a='" . $_POST["F1A$l"] . "'";

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.