PHP Mysql multiple insert with foreach not working

Question

Here is my code - I'm attempting to attach a bunch of user_id 's to a piece of content.

if (empty($errors)) // If everything's OK.
{ 
    foreach($_POST['userId'] as $row)
    {
        $query = " ('".$row[learner_id]."', '".$postId."', '".$id."' ),";
    }

    $query = substr_replace($query,"",-1);
    $mysql_return = mysqli_query("INSERT INTO subs (userId, postId, account_id ) VALUES ".$query) or die(mysql_error());
}

Would love any help you could give - it's not working...

What error do you have? I guess you have an extra , at then end of your statement. — pascal
– pascal, Commented Jan 28, 2011 at 4:12
he error message I get is "mysqli_query() expects at least 2 parameters, 1 given" on that last line... — WillHerndon
– WillHerndon, Commented Jan 28, 2011 at 4:13

Marc B · Accepted Answer · 2011-01-28 04:11:19Z

1

And how's it not working? Syntax error? Silently puking? You're not escaping your POST data, so if any of those contain at least one single quote, that'll cause a syntax error right there, plus leaving you wide open for sql injection attacks.

Or maybe a foreign key check is failing... many possibilities, but you haven't given us nearly enough info to tell. What error message(s) are you getting?

answered Jan 28, 2011 at 4:11

Marc B

362k44 gold badges433 silver badges508 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

WillHerndon Over a year ago

The error message I get is "mysqli_query() expects at least 2 parameters, 1 given" on that last line... (I'll also add the mysqli_real_escape_string to the post data)

Marc B Over a year ago

The first argument to most mysqli_*() functions in procedural mode should be the database link handle.

gahooa · Accepted Answer · 2011-01-28 04:13:33Z

0

Ok, I see several issues:

You are not using parameters or escaping, opening yourself up WIDE to sql injection attacks. See mysqli_real_escape_string.
What are you possibly sending to $_POST['userId'] that would make itself an array?
Unless learner_id is a constant, then this is a syntax error. If it is an array key, put it in quotes.
Where are $postId and $id coming from ?

answered Jan 28, 2011 at 4:13

gahooa

138k14 gold badges101 silver badges104 bronze badges

1 Comment

WillHerndon Over a year ago

Thank. 1. I know I've got to escape the post data. 2. The info sent there is the Id's from a form - I can verify it's being sent in an array. 3. learner_id was a copy/paste mistake, should read userId... it does in my script. 4. $postId and $id are constants

Rich Adams · Accepted Answer · 2011-01-28 04:19:13Z

0

The first parameter to mysqli_query is the identifier returned by mysqli_connect, whereas you're just giving it the query directly.

It should be like this,

$link = mysqli_connect("host", "user", "pass", "db");
$mysql_return = mysqli_query($link, "INSERT INTO subs (userId, postId, ac...

answered Jan 28, 2011 at 4:19

Rich Adams

26.7k4 gold badges43 silver badges62 bronze badges

Collectives™ on Stack Overflow

PHP Mysql multiple insert with foreach not working

3 Answers 3

2 Comments

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related