How to call a function/method in php to insert function return value to mysql

Question

<?php
$fname = $_POST['fname'];
$lname = $_POST['lname'];
$email = $_POST['email'];

function random_string($length) {
    $key = '';
    $keys = array_merge(range(0, 9), range('a', 'z'));

    for ($i = 0; $i < $length; $i++) {
        $key .= $keys[array_rand($keys)];
    }

    return $key;
}

if($email)
{

$connect = mysql_connect(" HOST ", " USERNAME ", " PASSWORD") or die("Couldn't Connect");

mysql_select_db("CiniCraftData") or die ("Couldn't Find Database"); 

            $query = "INSERT INTO customers (fname, lname, email, alphanum) VALUES ('$fname', '$lname', '$email', 'random_string(10)')";
            $result = mysql_query($query) or die("Some kind of error occured.");

            echo ("Welcome " + $username + ", you are now in my database!");

}
else die("You did not fill out the fields correctly, please try again.");

?>

I need help with the line in the middle that starts with $query = "INSER ... 'random_string(10)')";

I need a random alphanumeric string to be inserted into the table called "customers" but instead of calling the function "random_string()" it inserts "random_string(10)" into my table which gives me this for my table with 6 fields:

5   John    Smith   [email protected] random_string(10)   0

How do I fix this?

You shouldn't include the username and pass for your DB when you post questions — ohiock
– ohiock, Commented Dec 31, 2012 at 0:43
Compulsory comment - please use mysqli or pdo instead of mysql_* functions - they've been deprecated — Alfo
– Alfo, Commented Dec 31, 2012 at 0:47

Pankucins · Accepted Answer · 2012-12-31 00:42:34Z

3

$query = "INSERT INTO customers (fname, lname, email, alphanum) VALUES ('$fname', '$lname', '$email', '" . random_string(10) . "')";

This should work! I think that even though double quotes will parse variables, they wont parse functions.

answered Dec 31, 2012 at 0:42

Pankucins

1,7301 gold badge16 silver badges25 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Community · Accepted Answer · 2017-05-23 12:18:46Z

2

concatenate the function and your string,

$query = "INSERT INTO customers (fname, lname, email, alphanum) VALUES ('$fname', '$lname', '$email', '" . random_string(10) ."')";

As a sidenote, the query is vulnerable with SQL Injection if the values of the variable came from the outside. Please take a look at the article below to learn how to prevent from it. By using PreparedStatements you can get rid of using single quotes around values.

How to prevent SQL injection in PHP?

edited May 23, 2017 at 12:18

CommunityBot

11 silver badge

answered Dec 31, 2012 at 0:43

John Woo

265k70 gold badges509 silver badges500 bronze badges

Comments

agim · Accepted Answer · 2012-12-31 00:43:58Z

0

make two statements of it. In the first statement you call your function and assign the value to a variable and then in your INSERT... statement you use the variable

answered Dec 31, 2012 at 0:43

agim

1,84113 silver badges19 bronze badges

Collectives™ on Stack Overflow

How to call a function/method in php to insert function return value to mysql

3 Answers 3

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related