how to insert multiple variables into a sql query

Question

<?php
  session_start();
  include('function.php');

  site::db();
  $type=$_GET['type'];
  $date=$_GET['date'];
  $amount=$_GET['amount'];

  switch($type) {
    case "in_park":
      $table = "lot_income";
      $col = "date,amount";
      $val = $date $type $amount;
      break;
  }

  $sql = mysql_query("INSERT INTO $table ($col) VALUES ('$val')");
  if(!$sql) {
    die(mysql_error());
  } 

  //header("LOCATION: dashboard.php")
?>

This will not work but im assuming that i will will need to explode the variables val but how to i put the comma in there too so i can put the info in many different field other than just one field.

Why do people keep using mysql_* when there have been better alternatives available for years? Look at PDO or mysqli. Also, you might want to read up on SQL injection. — GordonM
– GordonM, Commented Mar 31, 2012 at 18:33

Xfile · Accepted Answer · 2012-03-31 18:34:50Z

1

Change this..

$val=$date $type $amount;

Into this

$val= "'$date', '$amount'";

And thius

$sql=mysql_query("INSERT INTO $table ($col) VALUES ('$val')");

into this

$sql=mysql_query("INSERT INTO $table ($col) VALUES ($val)");

answered Mar 31, 2012 at 18:34

Xfile

6848 silver badges19 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Alexander · Accepted Answer · 2012-03-31 18:42:30Z

1

I think you are missing a column in your SQL statement:

$col = "date, type, amount";

You will need to format the SQL values accordingly:

$val = "'$date', '$type', '$amount'";

Concatenate them:

$sql = mysql_query("INSERT INTO $table ($col) VALUES ($val)");

answered Mar 31, 2012 at 18:42

Alexander

23.5k11 gold badges65 silver badges74 bronze badges

Comments

Maxime Pacary · Accepted Answer · 2012-03-31 18:59:36Z

1

I usually do:

$table = "lot_income";

$data = array(
    'date' => "'".mysql_real_escape_string($date)."'", // date
    'type' => intval($type), // integer
    'amount' => intval($amount), // integer
    'text' => "'".mysql_real_escape_string($sometext)."'" // string
    // etc
  );

// I tend to wrap the following statement in a function for code reuse

$resource = mysql_query(
    "INSERT INTO ".$table." (".implode(", ", array_keys($data).")"
    . "VALUES (".implode(", ", array_values($data).")"
   );

Note: for values escaping (in order to avoid SQL injections), it would be easier/safer to bind variables by using PHP extension PDO or mysqli.

edited Mar 31, 2012 at 18:59

answered Mar 31, 2012 at 18:51

Maxime Pacary

23.2k12 gold badges92 silver badges117 bronze badges

Collectives™ on Stack Overflow

how to insert multiple variables into a sql query

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related