insert array into MySQL DB (unexpected T_STRING)

Question

I'm trying to add values from array to DB, have tried many variuos examples but still no luck. With other ways I can insert into DB only last array value.. Any help would be appreciated.

$max=count($_SESSION['cart']);
for($i=0;$i<$max;$i++){
$pid=$_SESSION['cart'][$i]['productid'];
$ppid=get_product_id($pid);
$ppav=get_product_name($pid);
$price=get_price($pid);
$date=date('Y-m-d');
$orderid=mysql_insert_id();
$customerid=mysql_insert_id();

$array['cust_id'] = $customerid;
$array['prod_id'] = $ppid;
$array['prod_name'] = $ppav;
$array['price'] = $price;
$array['date'] = $date;

$sql1 = array(); 
foreach( $array as $row ) {
$sql1[] = '('null', '.$row['cust_id'].', '.$row['prod_id'].', '.$row['prod_name']', '.$row['price'].', '.$row['date'].')';
                                    }
mysql_query('INSERT INTO orders (id, cust_id, prod_id, prod_name, price, date) VALUES '.implode(',', $sql1));


}

WARNING your code is VERY susceptible to sql injection attacks. — Daniel A. White
– Daniel A. White, Commented Mar 20, 2012 at 17:47
Hi, yea I know, I'll solve sql injection problems right after this. Thanks — dojo
– dojo, Commented Mar 20, 2012 at 18:04

Marc B · Accepted Answer · 2012-03-20 17:49:14Z

1

$sql1[] = '('null', '.$row['cust_id'].', '.$row['prod_id'].', '.$row['prod_name']', '.$row['price'].', '.$row['date'].')';

should probably be

$sql1[] = "(null, '" . $row['cust_id'] . "', '" . etc....

You're generating bad PHP strings, causing your syntax errors. And note that this code is vulnerable to SQL injections. Even though this data appears to be coming out of a DB initially, you can still inject yourself.

answered Mar 20, 2012 at 17:49

Marc B

362k44 gold badges433 silver badges508 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

flo · Accepted Answer · 2012-03-20 17:49:16Z

0

You don't need ' for null in your $sql1 statement:

Try:

$sql1[] = '(null, '.$row['cust_id'] ...

answered Mar 20, 2012 at 17:49

flo

2,01813 silver badges15 bronze badges

Comments

nathanjosiah · Accepted Answer · 2012-03-20 17:56:44Z

As Daniel A. White pointed out, your code is very susceptible to SQL injection, but here is a working version of the code you gave:

<?php

$max = count($_SESSION['cart']);
for($i = 0; $i < $max; $i++) {
    $pid = $_SESSION['cart'][$i]['productid'];
    $ppid = get_product_id($pid);
    $ppav = get_product_name($pid);
    $price = get_price($pid);
    $date = date('Y-m-d');
    $orderid = mysql_insert_id();
    $customerid = mysql_insert_id();

    $array['cust_id'] = $customerid;
    $array['prod_id'] = $ppid;
    $array['prod_name'] = $ppav;
    $array['price'] = $price;
    $array['date'] = $date;

    $sql1 = array();
    foreach($array as $row) {
        $sql1[] = '(NULL, '.$row['cust_id'].', '.$row['prod_id'].', "'.$row['prod_name'].'", ' . $row['price'] . ', "' . $row['date'] . '")';
    }
    mysql_query('INSERT INTO orders (id, cust_id, prod_id, prod_name, price, date) VALUES ' . implode(',',$sql1));

}
?>

Also, I would suggest getting a decent code editor, (I use Zend Studio which is a better version of the free Eclipse PDT) or at least one with error highlighting to prevent common errors like this.

Collectives™ on Stack Overflow

insert array into MySQL DB (unexpected T_STRING)

3 Answers 3

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related