Form Looping

Stephen68

Ok I have a form that I loop through and create the query string from. The problem I'm having is that I have a few fields that I don't want to add into the query string until a later time. I'm using and if with some || in it but it does not seem to work, anybody have any idea's why?

	//Loop through the form field and values and store then in an array
	foreach ($_POST as $field=>$value) {//Start foreach loop
	    //If the $field is month,day,year,submit2 or submit33 then skip them
		if ($field != "month" || $field != "day" || $field != "deadline_year" || $field != "submit2" || $field != "submit33") {
			//Add Slashes for safe insert into database
		    $vaule = addslashes($value);

	    $names[] = "$field="."'".$value."'";
	}
}// end of foreach loop

Cheers!
Stephen

bradgrafelman

The problem is with your logic; you don't want logical OR, you'd want logical AND.

It might be easier, however, to use [man]in_array/man like so:

$exclude = array("month", "day", "year", "etc.");

foreach ($_POST as $field=>$value) {
    if(!in_array($field, $exclude)) {
        // process field
    }
}

Also, a minor security warning: with the code you have above, you're allowing anyone who has access to this script to change any column in the table. In addition, your code is vulnerable to SQL injection attacks. User-supplied data should never be placed directly into a SQL query. Instead, it should first be sanitized with a function such as [man]mysql_real_escape_string/man (assuming you're using the MySQL DBMS).

Stephen68

Thanks man that's all I needed a push in the right direction, I should of thought about that. I'll take your advice and use mysql_real_escape_string(), I should be able to just do the string at once after the loop right.

I implode the array into a string so I could do something like this

$updateString = implode(",",$names);

$updateString = mysql_real_escape_string($updateString);

would that be right?