Loop insert problem

grumpy

I have a form with 10 fields named supplies1, supplies2...supplies10. I have written code to loop through the form results and insert into a database based on an id field. My code inserts the rows that contain data correctly. However, if the user only uses 3 of the 'supplies' fields on the form, my loop enters the 3 rows of data and 7 rows with no content. The insert should only insert rows that contain data, i.e. only 3 rows, for example.
What am I doing wrong? My loop insert code is below. Thanks.

 
$ID = $_GET['ID'];


for ($i=1; $i<=(count($_POST)/1);$i++) {

if(isset($_POST['supplies'.$i])){ 

$supplies = $_POST['supplies'.$i];



if ($submit == "SUBMIT"){
$sql = "INSERT INTO supplies2 SET 
project_ID='$ID',
supplies='$supplies'

";
if (@mysql_query($sql)) {
echo("<script language='javascript'>location.href='uploadimages.php?ID=$ID'</script>");
} 
} 

}

bradgrafelman

Check if $_POST['supplies'.$i] is an empty string before you perform the query.

Also note that it appears as though your script is vulnerable to SQL injection attacks. User-supplied data should never be placed directly into a SQL query but should instead be sanitized first, with a function such as [man]mysql_real_escape_string/man.

grumpy

You're right, using the 'empty' function was the answer. This works:

for ($i=1; $i<=(count($_POST)/1);$i++) {

if(isset($_POST['supplies'.$i]) && !empty($_POST['supplies'.$i])){  

$supplies = $_POST['supplies'.$i];

...

bradgrafelman

Heh... what's the point in dividing the count() by 1?

Anyway, don't forget to mark this thread resolved.

EDIT: By the way, that for() loop could probably be better written as:

for($i = 1; isset($_POST["supplies$i"]; $i++) {

Then of course you'd get rid of the isset() inside the loop and only check if it's empty.