HELP: insert problem!

[sander_ESP]

hello,

i am trying to insert some data into a mysql database.

here is het code :

<?
$conn = mysql_connect($host, $user, $pass)
OR DIE (mysql_error());
@mysql_select_db ($db, $conn) OR DIE (mysql_error());



$sqldate ="select date from calender where cal_ID =".$date_ID;
$result=mysql_query($sqldate);

$sqlID  ="select cal_ID from calender where cal_ID =".$date_ID;
$resultID=mysql_query($sqlID);
list ($listID) = mysql_fetch_array ($resultID);
list ($resulttest) = mysql_fetch_array ($result);

echo $listID;
if ($_SERVER['REQUEST_METHOD'] == "POST")  

    { 
        # escape data and set variables 
        $Datecooking = addslashes($_POST["date"]); 
        $people = addslashes($_POST["people"]); 
        $datebooking = addslashes($_POST["booking"]); 
   		$who = addslashes($_POST["who"]); 
		$price = addslashes($_POST["price"]);


$sqlinsert  = " INSERT INTO details "; 
$sqlinsert .= " (cal_ID, price, date, number, who) VALUES "; 
$sqlinsert .= " ('$listID', '$price','$datebooking','$people','$who') "; 		


    #execute SQL statement 
    $resultinsert = mysql_query($sqlinsert); 

    # check for error 
    if (mysql_error()) { print "Database ERROR: " . mysql_error(); } 

} 
?>

<form name="fa" action="add.php" method="POST">      

    <table>                                                                                                         

    <tr><td><b>DATE of cooking class</b> </td><td><? echo $resulttest ?></td></tr>

<tr><td><b>number of people </b> </td><td><input type="text" name="people" size=2></td></tr>
  <tr><td><b>Price</b> </td><td><input type="text" name="price" size=2></td></tr>
<tr><td><b>date of booking</b> </td><td><input type="text" name="booking" size=10></td></tr> 
<tr><td valign=top><b>booked by </td><td> Travelbar <INPUT NAME="who" TYPE=radio VALUE="travelbar">
<LI>The Shop<INPUT NAME="who" TYPE=radio VALUE="The Shop">
</td></tr> 
    <tr><th colspan=2><p><input type="submit" value="Add Record"></p></th></tr>  

    </table> 
    </form>   

all the data gets inserted fine except for the cal_ID. this is always inserted as zero?

the cal_id is an unique number that gets passed on from a different php page.
the echo shows the right value for this variable but when submit form is pressed , it seems to go wrong..

[Piranha]

Don't use addslashes. It does add slashes before some characters, but since it is to use for a wide range of databases it doesn't suit any of them. Use [man]mysql_real_escape_string[/man] for MySQL databases instead.

Unfortunatley I have no idea on how to solve the problem you post about. I could try to guess, but it is better if someone that knows answers that question.

[Sxooter]

Also, there are tricks with encoding one can use to trick addslashes and manage to still inject SQL in the db server. addslashes is dangerous, as is magic_quotes_gpf.

as for cal_id, try changing it aLl to LoWeR cAsE, InClUdINg the nAmE of THe fiELd in the dAtaBAse.