Is it possible to insert the contents of 2 form fields into one database field

maxwell_

Is it possible to insert the contents of 2 form fields into one
database field by concatinating them together.

Something like this

if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] == "frm_register")) {
  $insertSQL = sprintf("INSERT INTO users (name, user_name, user_password, user_email, userGroup) VALUES (%s, %s, %s, %s, %s)",
  						GetSQLValueString($_POST['name'] . ' ' . $_POST['surname']),
						GetSQLValueString($_POST['user_name'], "text"),
                       GetSQLValueString($_POST['user_password'], "text"),
					   GetSQLValueString($_POST['user_email'], "text"),
                       GetSQLValueString($_POST['userGroup'], "text"));

I tried the above and received this error -

Fatal error: Call to undefined function GetSQLValueString()

Derokorian

Is it possible to insert the contents of 2 form fields into one
database field by concatinating them together.

Yes, it is. You could even concatenate 50 fields into one column if you so desired.

Fatal error: Call to undefined function GetSQLValueString()

This means that the function definition wasn't found when running this script. either the file it is defined in wasn't included, or the function isn't defined at all. Also note: The first call to it has a different format than the others, and should probably be:

GetSQLValueString($_POST['name'] . ' ' . $_POST['surname'],"text"),

To make it work when you get the definition included.

maxwell_

Thanks for the help!

I added the function to the page and everything is now working!

function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = ""){  $theValue = (!get_magic_quotes_gpc()) ? addslashes($theValue) : $theValue;  switch ($theType) {    case "text":      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";      break;        case "long":    case "int":      $theValue = ($theValue != "") ? intval($theValue) : "NULL";      break;    case "double":      $theValue = ($theValue != "") ? "'" . doubleval($theValue) . "'" : "NULL";      break;    case "date":      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";      break;    case "defined":      $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;      break;  }  return $theValue;}

Best regards Maxwell

johanafm

If magic_quotes_gpc is NOT used you go ahead and actually call addslashes. Adding slashes has nothing to do with sanitizing strings for use in SQL queries. magic_quotes_gpc really shouldn't be turned on in the first place. So if you do check for something, the way to do it is

if (get_magic_quotes_gpc())
   $val = stripslashes($val);

I.e. if magic_quotes_gpc is used, you reverse the process as soon as you can!

Thereafter, you should go ahead and apply a function that actually has anything to do with sanitizing strings for use not just with SQL queries, but actually for your particular DBMS.
[man]mysqli_real_escape_string[/man]
[man]pg_escape_string[/man]
...