$_REQUEST in SQL?

[matthewdingley]

Hi,

I'm quite new to all this $_REQUEST stuff and I'm trying to change all my code so that it will work with register globals off (it has to be quite cross platform). The problem I have is when I try to put data from a form into a database.
Here is the code I am using

if($_REQUEST ['title']||$_REQUEST ['date']||$_REQUEST ['summary']||$_REQUEST ['full'])
{
$insertIt=mysql_query("INSERT INTO `mdnews` (`title`, `date`, `summary`, `full`) VALUES ('$_REQUEST [title]', '$_REQUEST [date]', '$_REQUEST [date]', '$_REQUEST [full]') ",$db); 
if($insertIt)
{
echo "The newsitem $title has been successfully added<br>";
}
else
{
echo "Sorry there has been an error, please try again<br>";
}
}

The variables are working in the IF statement but I've tried every combination of quotes, double quotes etc to get it to work.

Any help would be greatly appreciated.

Thanks.

[stolzyboy]

<?
if($_REQUEST['title'] && $_REQUEST['date'] && $_REQUEST['summary'] && $_REQUEST['full'])
{ //i changed the ||'s to &&'s makes more sense to me than ors do, but if not change them back
extract($_POST); //if info is with post method : most likely your situation
//extract($_GET); //if into is with get method
$query = "INSERT INTO `mdnews` (`title`, `date`, `summary`, `full`) VALUES ('$title', '$date', '$date', '$full');";
$result = mysql_query($query) or die(mysql_error()); 
if($result)
{
echo "The newsitem $title has been successfully added<br>";
}
else
{
echo "Sorry there has been an error, please try again<br>";
}
}
?>

[matthewdingley]

Thanks, that's sorted it out.

[Spudgun]

Stolyzboy - you're a diamond! I've been struggling with this and have resorted to creating new variables from the existing $_POST variables.
extract has opened my eyes!

Thanks a lot! 😃

[laserlight]

A word of warning though: you should ensure that register_globals is set to Off, otherwise careless use of extract($_POST) could allow variable poisoning.

In this case it is perfectly safe either way, but that is because the variables used have been checked to begin with.