Making a loop that updates mysql tables

[BadBoy8]

Halp

I need your help, my php code is not working.

Ok ok I have a small PHP-site that I try to work with, and here's the following I need help with:

form sends _POST variables $a_1, $a_2, $a_3... etc. to my .php page which should update my mysql tables with these variables. Now to teh problem, i know how to update tables manually like:

foreach ($_POST as $key=>$val){
$$key = $val;
}

$sql = "UPDATE abc SET a_1='$a_1',a_2='$a_2',a_3='$a_3' WHERE id='$id'"
mysql_query($sql,$db);

how can i get this to work automatically without adding all the a_1='a_1' stuff in there? the following doesn't work:

foreach ($_POST as $key=>$val){
$$key = $val;
}

$poop=1;
while($poop<4)
{
$sql = "UPDATE abc SET a$poop='$a$poop' WHERE id='$id'"
mysql_query($sql,$db);

$poop++;
}

AND this doesn't work either

foreach ($_POST as $key=>$val){
$$key = $val;
}

$poop=1;
while($poop<4)
{
$dodo="a_".$poop;

$sql = "UPDATE abc SET $dodo='$dodo' WHERE id='$id'"
mysql_query($sql,$db);

$poop++;
}

Please halp and... thanks for halping. :o

[bradgrafelman]

Well, you could dynamically build a field list:

for($i=1, $fields=''; isset($_POST['a_' . $i]); $i++)
    $fields .= "a_$i = '" . $_POST['a_' . $i] . '\', ';

$query = 'UPDATE abc SET ' . mysql_real_escape_string(rtrim($fields, ', '));

Also note that your code (and I based my snippet on yours) is vulnerable to SQL injection attacks; user-supplied data should never be placed directly into a SQL query string. Instead, you should first sanitize it with a function such as [man]mysql_real_escape_string/man.