[RESOLVED] rtrim (array values) before SQL Insert

predator

Background:
Using PHP+Ajax+JS i have a form that automatically fills a <input type="text"> form field with data. For some darn reason, it adds an extra space after the text. Cannot figure it out, so I thought I solve it with rtrim($variable, " ");

Problem:
There are multiple rows being submitted and I am not sure how to correctly trim all array values. The data that needs to be trimmed is $_POST['league'][$i]
Code:

 $values = array();

//Order all collected data for coming SQL insertion
for ($i=0; $i<count($_POST['startdate']); $i++) {

   if (!empty($_POST['startdate'][$i])) {
      $values[] = "('{$_POST['PlayerID']}', '{$_POST['team'][$i]}', NULL, '{$_POST['startdate'][$i]}', 
'{$_POST['enddate'][$i]}', '{$_POST['league'][$i]}', '{$_POST['gp'][$i]}', 
'{$_POST['g'][$i]}', '{$_POST['a'][$i]}', '{$_POST['tp'][$i]}', '{$_POST['pim'][$i]}', 
'{$_POST['league2'][$i]}', '{$_POST['gp2'][$i]}', '{$_POST['g2'][$i]}', '{$_POST['a2'][$i]}', 
'{$_POST['tp2'][$i]}', '{$_POST['pim2'][$i]}')";
   }

}

//Run the Insert query
if (!empty($values)) {

   $values = implode(", ", $values);

   $sql = "INSERT INTO stats(PlayerID, TeamID, KID, StartDate, EndDate, League, GP, G, A, TP, PIM, 
League2, GP2, G2, A2, TP2, PIM2) VALUES $values";

mysql_query($sql);

}

laserlight

predator wrote:
The data that needs to be trimmed is $POST['league'][$i]

One way to handle this is:

foreach ($_POST['league'] as &$value) {
    $value = rtrim($value);
}

predator

thanks for the input laserlight, could I ask you where in my above current code I should place it to get it to work? Guess I am not sure how it affects my " $values[] =" ... row

laserlight

At a suitable point before you use any element of $_POST['league'].

predator

gahh... did not get it to work (really need to learn more about arrays and foreach).
However, I did solve it using:

[FONT="Courier New"]for ($i=0; $i<count($_POST['startdate']); $i++) {

$value[$i] = $_POST['league'][$i];
$value[$i] = rtrim($value[$i]," ");

$values[] = ........ '{$_POST['enddate'][$i]}', '{$value[$i]}',.........

}[/FONT]

Please let me know if there is a reason as to why absolutely not use my solution above 🙂 Cheers!

bradgrafelman

One reason not to use your code above is that it leaves you vulnerable to SQL injection attacks and/or just plain SQL errors. User-supplied data should never be placed directly into a SQL query; instead, it must first be sanitized with a function such as [man]mysql_real_escape_string/man (for string data).