Take the 2-minute tour ×
Stack Overflow is a question and answer site for professional and enthusiast programmers. It's 100% free, no registration required.

I'm trying to add values from array to DB, have tried many variuos examples but still no luck. With other ways I can insert into DB only last array value.. Any help would be appreciated.

$max=count($_SESSION['cart']);
for($i=0;$i<$max;$i++){
$pid=$_SESSION['cart'][$i]['productid'];
$ppid=get_product_id($pid);
$ppav=get_product_name($pid);
$price=get_price($pid);
$date=date('Y-m-d');
$orderid=mysql_insert_id();
$customerid=mysql_insert_id();

$array['cust_id'] = $customerid;
$array['prod_id'] = $ppid;
$array['prod_name'] = $ppav;
$array['price'] = $price;
$array['date'] = $date;

$sql1 = array(); 
foreach( $array as $row ) {
$sql1[] = '('null', '.$row['cust_id'].', '.$row['prod_id'].', '.$row['prod_name']', '.$row['price'].', '.$row['date'].')';
                                    }
mysql_query('INSERT INTO orders (id, cust_id, prod_id, prod_name, price, date) VALUES '.implode(',', $sql1));


}
share|improve this question
1  
WARNING your code is VERY susceptible to sql injection attacks. –  Daniel A. White Mar 20 '12 at 17:47
2  
your error is here btw: $sql1[] = '('null', –  Daniel A. White Mar 20 '12 at 17:48
    
Hi, yea I know, I'll solve sql injection problems right after this. Thanks –  Deividas Juškevičius Mar 20 '12 at 18:04
add comment

3 Answers

up vote 1 down vote accepted
$sql1[] = '('null', '.$row['cust_id'].', '.$row['prod_id'].', '.$row['prod_name']', '.$row['price'].', '.$row['date'].')';

should probably be

$sql1[] = "(null, '" . $row['cust_id'] . "', '" . etc....

You're generating bad PHP strings, causing your syntax errors. And note that this code is vulnerable to SQL injections. Even though this data appears to be coming out of a DB initially, you can still inject yourself.

share|improve this answer
add comment

You don't need ' for null in your $sql1 statement:

Try:

$sql1[] = '(null, '.$row['cust_id'] ...
share|improve this answer
add comment

As Daniel A. White pointed out, your code is very susceptible to SQL injection, but here is a working version of the code you gave:

<?php

$max = count($_SESSION['cart']);
for($i = 0; $i < $max; $i++) {
    $pid = $_SESSION['cart'][$i]['productid'];
    $ppid = get_product_id($pid);
    $ppav = get_product_name($pid);
    $price = get_price($pid);
    $date = date('Y-m-d');
    $orderid = mysql_insert_id();
    $customerid = mysql_insert_id();

    $array['cust_id'] = $customerid;
    $array['prod_id'] = $ppid;
    $array['prod_name'] = $ppav;
    $array['price'] = $price;
    $array['date'] = $date;

    $sql1 = array();
    foreach($array as $row) {
        $sql1[] = '(NULL, '.$row['cust_id'].', '.$row['prod_id'].', "'.$row['prod_name'].'", ' . $row['price'] . ', "' . $row['date'] . '")';
    }
    mysql_query('INSERT INTO orders (id, cust_id, prod_id, prod_name, price, date) VALUES ' . implode(',',$sql1));

}
?>

Also, I would suggest getting a decent code editor, (I use Zend Studio which is a better version of the free Eclipse PDT) or at least one with error highlighting to prevent common errors like this.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.