Insertion Problems for new fields

[CodeMama]

I have added a couple new fields to a db table, fields exactly like other fields, and so I thought I would use the same code to grab the data and insert it to the db, but when I try that, stuff gets crazy, for one, the new fields cause everything to insert where ever it wants, it starts dumping data in the table in whatever fields, no rhyme no reason....

<?php
include("inc/dbconn_open.php");

if (empty($_SESSION['AdminLogin']) OR $_SESSION['AdminLogin'] <> 'OK' ){
    header ("Location: LogOut.php");
}

if (isset($_POST['AdminID'])){
    $AdminID = $_POST['AdminID'];
} elseif (isset($_GET['AdminID'])){
    $AdminID = $_GET['AdminID'];
} else {
    header ("Location: LogOut.php");
}

if (!empty($_POST['GO'])){$GO = $_POST['GO'];} else {$GO = "";}
if (isset($_POST['Location'])){$Location = $_POST['Location'];} else {$Location = "";}
if (isset($_POST['WorkOrderName'])){$WorkOrderName = $_POST['WorkOrderName'];} else {$WorkOrderName = "";}
if (!empty($_POST['Customer'])){$Customer = $_POST['Customer'];} else {$Customer = "";}

if (!empty($_POST['AccountNum'])){$AccountNum = $_POST['AccountNum'];} else {$AccountNum = "";}
if (!empty($_POST['IONum'])){$IONum = $_POST['IONum'];} else {$IONum = "";}
if (!empty($_POST['StartMonth']) && !empty($_POST['StartDay']) && !empty($_POST['StartYear'])){
    $StartDate = $_POST['StartYear'] ."-". $_POST['StartMonth'] ."-". $_POST['StartDay'];
} else {
    $StartDate = "";
}
if (!empty($_POST['EndMonth']) && !empty($_POST['EndDay']) && !empty($_POST['EndYear'])){
    $EndDate = $_POST['EndYear'] ."-". $_POST['EndMonth'] ."-". $_POST['EndDay'];
} else {
    $EndDate = "";
}
if (!empty($_POST['Headline'])){$Headline = $_POST['Headline'];} else {$Headline = "";}
if (!empty($_POST['Body'])){$Body = $_POST['Body'];} else {$Body = "";}
if (!empty($_POST['URL'])){$URL = $_POST['URL'];} else {$URL = "";}
if (!empty($_POST['SearchTerm1'])){$SearchTerm1 = $_POST['SearchTerm1'];} else {$SearchTerm1 = "";}
if (!empty($_POST['SearchTerm2'])){$SearchTerm2 = $_POST['SearchTerm2'];} else {$SearchTerm2 = "";}
if (!empty($_POST['SearchTerm3'])){$SearchTerm3 = $_POST['SearchTerm3'];} else {$SearchTerm3 = "";}
if (!empty($_POST['SearchTerm4'])){$SearchTerm4 = $_POST['SearchTerm4'];} else {$SearchTerm4 = "";}
if (!empty($_POST['SearchTerm5'])){$SearchTerm5 = $_POST['SearchTerm5'];} else {$SearchTerm5 = "";}
if (isset($_POST['Salesperson'])){$Salesperson = $_POST['Salesperson'];} else {$Salesperson = "";}
if (isset($_POST['SalespersonID'])){$SalespersonID = $_POST['SalespersonID'];} else {$SalespersonID = "";}
if (isset($_POST['SalespersonEmail'])){$SalespersonEmail = $_POST['SalespersonEmail'];} else {$SalespersonEmail = "";}
if (isset($_POST['SalespersonExt'])){$SalespersonExt = $_POST['SalespersonExt'];} else {$SalespersonExt = "";}
if (isset($_POST['Comments'])){$Comments = $_POST['Comments'];} else {$Comments = "";}
if (isset($_POST['ExtraImage1Desc'])){$ExtraImage1Desc = $_POST['ExtraImage1Desc'];} else {$ExtraImage1Desc = "";}
if (isset($_POST['ExtraImage2Desc'])){$ExtraImage2Desc = $_POST['ExtraImage2Desc'];} else {$ExtraImage2Desc = "";}
if (isset($_POST['ExtraImage3Desc'])){$ExtraImage3Desc = $_POST['ExtraImage3Desc'];} else {$ExtraImage3Desc = "";}
if (isset($_POST['ExtraImage4Desc'])){$ExtraImage4Desc = $_POST['ExtraImage4Desc'];} else {$ExtraImage4Desc = "";}
if (isset($_POST['ExtraImage5Desc'])){$ExtraImage5Desc = $_POST['ExtraImage5Desc'];} else {$ExtraImage5Desc = "";}
if (isset($_POST['NewFieldDesc'])){$NewFieldDesc = $_POST['NewFieldDesc'];} else {$NewFieldDesc = "";}


if ($GO == "Save") {
    $sql = "SELECT Name FROM admin WHERE AdminID='$AdminID'";
    $result = mysql_query ($sql);
    $row = mysql_fetch_object ($result);   

$Notes = "~". date("F j, Y g:i a") ." - Planet Discover Right Side Text Ad Submitted by ". $row->Name ."\n";

$sql = "INSERT INTO workorders (CreatedDate, Location, WorkOrderName, AdminID, FormName, Status, Notes) VALUES (";
$sql .= "Now(), '$Location', '$WorkOrderName', '$AdminID', 'PD_TextAd', 'New Order', '$Notes')";
mysql_query($sql);
$WorkOrderID = mysql_insert_id();

 if ($_FILES) {
    if (isset($_FILES['Logo'])) {
        if (is_uploaded_file ($_FILES['Logo']['tmp_name'])) {
            $ImageExt = strtolower(end(explode('.', $_FILES['Logo']['name'])));
            $Logo = "Artwork/". $WorkOrderID ."_Logo.". $ImageExt;
            move_uploaded_file($_FILES['Logo']['tmp_name'],$Logo);
        }
    }
    if (isset($_FILES['ExtraImage1'])) {
        if (is_uploaded_file ($_FILES['ExtraImage1']['tmp_name'])) {
            $ImageExt = strtolower(end(explode('.', $_FILES['ExtraImage1']['name'])));
            $ExtraImage1Name = "Artwork/". $WorkOrderID ."_Image1.". $ImageExt;
            move_uploaded_file($_FILES['ExtraImage1']['tmp_name'],$ExtraImage1Name);
        }
    }
    if (isset($_FILES['ExtraImage2'])) {
        if (is_uploaded_file ($_FILES['ExtraImage2']['tmp_name'])) {
            $ImageExt = strtolower(end(explode('.', $_FILES['ExtraImage2']['name'])));
            $ExtraImage2Name = "Artwork/". $WorkOrderID ."_Image2.". $ImageExt;
            move_uploaded_file($_FILES['ExtraImage2']['tmp_name'],$ExtraImage2Name);
        }
    }
    if (isset($_FILES['ExtraImage3'])) {
        if (is_uploaded_file ($_FILES['ExtraImage3']['tmp_name'])) {
            $ImageExt = strtolower(end(explode('.', $_FILES['ExtraImage3']['name'])));
            $ExtraImage3Name = "Artwork/". $WorkOrderID ."_Image3.". $ImageExt;
            move_uploaded_file($_FILES['ExtraImage3']['tmp_name'],$ExtraImage3Name);
        }
    }
    if (isset($_FILES['ExtraImage4'])) {
        if (is_uploaded_file ($_FILES['ExtraImage4']['tmp_name'])) {
            $ImageExt = strtolower(end(explode('.', $_FILES['ExtraImage4']['name'])));
            $ExtraImage4Name = "Artwork/". $WorkOrderID ."_Image4.". $ImageExt;
            move_uploaded_file($_FILES['ExtraImage4']['tmp_name'],$ExtraImage4Name);
        }
    }
    if (isset($_FILES['ExtraImage5'])) {
        if (is_uploaded_file ($_FILES['ExtraImage5']['tmp_name'])) {
            $ImageExt = strtolower(end(explode('.', $_FILES['ExtraImage5']['name'])));
            $ExtraImage5Name = "Artwork/". $WorkOrderID ."_Image5.". $ImageExt;
            move_uploaded_file($_FILES['ExtraImage5']['tmp_name'],$ExtraImage5Name);
        }
    }
if (isset($_FILES['NewField'])) {
            if (is_uploaded_file ($_FILES['NewField']['tmp_name'])) {
                $ImageExt = strtolower(end(explode('.', $_FILES['NewField']['name'])));
                $NewField = "Artwork/". $WorkOrderID ."_NewField.". $ImageExt;
                move_uploaded_file($_FILES['NewField']['tmp_name'],$NewField);
            }
        }


}

$sql = "INSERT INTO pd_textad (WorkOrderID, CreatedDate, Customer, AccountNum, IONum, StartDate, EndDate, Headline, Body,";
$sql .= "Logo, URL, SearchTerm1, SearchTerm2, SearchTerm3, SearchTerm4, SearchTerm5, Salesperson, SalespersonID, ";
$sql .= "SalespersonEmail, SalespersonExt, Comments, ExtraImage1, ExtraImage1Desc, ExtraImage2, ExtraImage2Desc, ";
$sql .= "ExtraImage3, ExtraImage3Desc, ExtraImage4, ExtraImage4Desc, ExtraImage5, ExtraImage5Desc, NewField) VALUES (";
$sql .= "'". mysql_real_escape_string($WorkOrderID) ."', Now(), ";
$sql .= "'". mysql_real_escape_string($Customer) ."', ";
$sql .= "'". mysql_real_escape_string($AccountNum) ."', ";
$sql .= "'". mysql_real_escape_string($IONum) ."', ";
$sql .= "'". mysql_real_escape_string($StartDate) ."', ";
$sql .= "'". mysql_real_escape_string($EndDate) ."', ";
$sql .= "'". mysql_real_escape_string($Headline) ."', ";
$sql .= "'". mysql_real_escape_string($Body) ."', ";
$sql .= "'". mysql_real_escape_string($Logo) ."', ";
$sql .= "'". mysql_real_escape_string($URL) ."', ";
$sql .= "'". mysql_real_escape_string($SearchTerm1) ."', ";
$sql .= "'". mysql_real_escape_string($SearchTerm2) ."', ";
$sql .= "'". mysql_real_escape_string($SearchTerm3) ."', ";
$sql .= "'". mysql_real_escape_string($SearchTerm4) ."', ";
$sql .= "'". mysql_real_escape_string($SearchTerm5) ."', ";
$sql .= "'". mysql_real_escape_string($Salesperson) ."', ";
$sql .= "'". mysql_real_escape_string($SalespersonID) ."', ";
$sql .= "'". mysql_real_escape_string($SalespersonEmail) ."', ";
$sql .= "'". mysql_real_escape_string($SalespersonExt) ."', ";
$sql .= "'". mysql_real_escape_string($Comments) ."', ";
$sql .= "'". mysql_real_escape_string($ExtraImage1Name) ."', ";
$sql .= "'". mysql_real_escape_string($ExtraImage1Desc) ."', ";
$sql .= "'". mysql_real_escape_string($ExtraImage2Name) ."', ";
$sql .= "'". mysql_real_escape_string($ExtraImage2Desc) ."', ";
$sql .= "'". mysql_real_escape_string($ExtraImage3Name) ."', ";
$sql .= "'". mysql_real_escape_string($ExtraImage3Desc) ."', ";
$sql .= "'". mysql_real_escape_string($ExtraImage4Name) ."', ";
$sql .= "'". mysql_real_escape_string($ExtraImage4Desc) ."', ";
$sql .= "'". mysql_real_escape_string($ExtraImage5Name) ."', ";
$sql .= "'". mysql_real_escape_string($ExtraImage5Desc) ."', ";
$sql .= "'". mysql_real_escape_string($NewField) ."') ";


mysql_query($sql) OR die(mysql_error());

The New Fields are EXACTLY like the ExtraImage and ExtraImageDesc fields, so why won't it work to just add them with the same script 😕format? I get no errors...only things dropping into whatever fields in the database, it throws everything off, like SalespersonID will dump into Logo etc, just craziness.

[djjjozsi]

why don't you create a function for the sql makeing... you're writing too much.

for example, i have one function to make insert sql string: You could make a part to file uploads.
You could make it easier.

function ins_user($fields,$table)
{
	$fields=str_replace("`","",$fields);
	$fields=str_replace("\r","",$fields);
	$sql="INSERT INTO `$table` (";
	$rows=explode(",",$fields);
	$i=0;
	while($rows[$i])
	{
		$one_part=explode("+",$rows[$i]);
		$one_part=trim($one_part[0]);

	if($rows[$i+1]=="")
		$sql.=" `".$one_part."` ";
	else
		$sql.=" `".$one_part."`, ";
	$i++;
}

$sql.=") VALUES (";

$i=0;
while($rows[$i])
{
	$one_part=explode("+",$rows[$i]);
	$sec_part=trim($one_part[1]);
	$one_part=trim($one_part[0]);

	if($sec_part=="md5")
	{
		$md5_beg=" md5(";
		$md5_end=") ";
	}
	else
	{	$md5_beg="";
		$md5_end="";
	}

	if($rows[$i+1]=="")
		$sql.=" $md5_beg'".$_POST["$one_part"]."'$md5_end ";  //this is the last element.
	else
		$sql.=" $md5_beg'".$_POST["$one_part"]."'$md5_end, ";
	$i++;
}

$sql.=");";

return($sql);
}

And the usage is:
print ins_user("`Name` ,`Address` ,`Phone` ,`Mobile` ,`Renewal` ,`email` ,`username`,`user_level`,`password1+md5`","collaborate_users");

and if a posted value sent with a form, it makes an sql query. There is a table_check function is too, to the other checking of a form element, but this function is too long to post here.

it explode the first strings into peaces, and explode if it has a + sign with other function, for example use md5 function. You could make a file uploader function too.