Tea_J;10983320 wrote:
yes it's integer, and yes i quoted it
Then your column is integer, but no, the data passed to it is not - it's a string literal.
-- integer
1
-- string
'1'
Which means that you are passing a string to be stored in a column with data type integer => type converstion needed.
Tea_J;10983320 wrote:
it's always worked for me..
which doesn't mean that it always will work, or that it's a good idea to do it that way.
SELECT '18015376320243459' = 18015376320243459;
produces 0 (false)
Tea_J;10983320 wrote:
sql_insert($table,$variables);
and i need not make that function complicated to figure out if im passing a variable w/ string or integer to decide wther to single quote the value part
var=value VS var='value'
which leads me to wonder if you deal with validation of user input. For example, since you pass neither data, nor a connection handle to sql_insert() which takes only 2 parameters instead of the expected 4, are you referencing $_POST variables directly and making use of global directive to reference your db connection handle, or do you not use mysql_real_escape_string?
I.e. can the user, by forging their own post request, manage SQL injection.
And no, it doesn't need to be complicated to get it done properly
$link = mysql_connect('ip','user','pass');
# Deals with creating the query, casting data to its proper type,
# uses mysql_real_escape_string to make strings safe
# and also disregards any value which is not explicitly permitted
function createInsertQuery($table, $fields, $values, $link)
{
if (count($fields) == 0 || count($values) == 0)
return '';
$useFields = array();
$useValues = array();
foreach ($fields as $name => $type)
{
if (isset($values[$name]))
{
$useFields[] = $name;
switch ($type)
{
case 'i':
$useValues[] = (int) $values[$name];
break;
case 'f':
$useValues[] = (float) $values[$name];
break;
default:
$useValues[] = sprintf("'%s'",
mysql_real_escape_string($values[$name], $link));
break;
}
}
}
return sprintf('INSERT INTO `%s`(%s) VALUES(%s)',
$table,
implode(', ', $useFields),
implode(', ', $useValues)
);
}
# Specifies which fields _may_ be included in the query and what table to use.
# Fields are only included if $post actually contains corresponding data.
function addUserQuery($post, $link)
{
static $fields = array(
'name' => 's',
'rank' => 'i',
'score' => 'f'
);
return createInsertQuery('user', $fields, $post, $link);
}
$_POST = array(
'name' => "O'brien",
# if data for some field is not supplied, it will of course not be included in the insert query
# 'rank' => '4',
'score' => '5.3',
# nor will data that is not explicitly allowed
'forged_post_reguest' => 'whatever'
);
$query = addUserQuery($_POST, $link);
