this is the error Fatal error: Call to undefined function assign(
this is the code, as you can see i obviously have defined the function so why is it not working
class shades {
function create($name, $shades, $slug, $shortDesc, $longDesc, $position){
$name = sanitize_paranoid_string($name);
$slug = slug($name);
$shortDesc = sanitize_sql_string($shortDesc);
$longDesc = sanitize_sql_string($longDesc);
$query = mysql_query("INSERT INTO products (type, name, slug, shortDesc, htmlDesc, position)VALUES('shades','$name','$slug','$shortDesc','$longDesc','$position')")or die(mysql_error());
$ID = mysql_insert_id();
assign($shades, $ID);
if($query) {return true;}
else {return false;};
}
function delassign($toID){
mysql_query("DELETE FROM assign WHERE type='shades' AND toID='$toID'")or die(mysql_error());
}
function assign($shades, $toID)
{
foreach($shades as $shade)
{
$result = mysql_query("INSERT INTO assign(type, typeID, toID)VALUES('shades','$shade','$toID')")or die(mysql_error());
if($result){echo "Added!";}
else{echo"Not Added!";}
};
}
}
delassign. To fix this hole, switch from the outdated mysql driver to PDO and use prepared statements. Note this is superior to explicit sanitization because while you can forget to sanitize, there is nothing security-wise to forget with prepared statement parameters (if you forget a parameter, PHP will generate an error informing you).