check my sql please

aron

is this correct (reg the $_POST) in the sql insert

<?
$street_number=ereg_replace("'","''",$_POST['street_number1']);


$sql = "INSERT into listings (street_number,street_name,postcode,...
values('$street_number', "$_POST['street_name']", "$_POST['postcode']", ...
?>

cheers aron.

htiek

Try this, it basically breaks the string at the " and joins the post variable via the '.' then joins the rest of the string via the ‘.’ again .. if that makes sense

myString = "this is a string ".$_POST['street_name']." this is part of the same string after the post var is added";

$sql = "INSERT into listings (street_number,street_name,postcode,...
values('$street_number', '".$_POST['street_name']."', '".$_POST['postcode']."', ...

nemonoman

First: I don't get this:

$street_number=ereg_replace("'","''",$_POST['street_number1']);

do you mean addslashes($_POST['street_number1']) ??

You can't successfully put named array elements in quotes in PHP

echo "$array[0]"; //this works
echo "$array['named']";// this doesn't

so either assign the (1) values to non-array variables OR (2)
concat the strings.

Also you can't just add quotes within quotes: you need to escape them

echo "\"Hi!,\", he said."

so this is basically mostly wrong:

$sql = "INSERT into listings (street_number,street_name,postcode,...
values('$street_number', "$POST['street_name']", "$POST['postcode']", ...

$street_name=$POST['street_name'];
postcode=$POST[postcode']";
$sql = "INSERT into listings (street_number,street_name,postcode,...
values('$street_number', '$street_name', $postcode...

$sql = "INSERT into listings (street_number,street_name,postcode,...
values('$street_number', '".$POST['street_name']."', '".$POST['postcode']."', ...

aron

thanks