How to call a function/method in php to insert function return value to mysql

Question

<?php
$fname = $_POST['fname'];
$lname = $_POST['lname'];
$email = $_POST['email'];

function random_string($length) {
    $key = '';
    $keys = array_merge(range(0, 9), range('a', 'z'));

    for ($i = 0; $i < $length; $i++) {
        $key .= $keys[array_rand($keys)];
    }

    return $key;
}

if($email)
{

$connect = mysql_connect(" HOST ", " USERNAME ", " PASSWORD") or die("Couldn't Connect");

mysql_select_db("CiniCraftData") or die ("Couldn't Find Database"); 

            $query = "INSERT INTO customers (fname, lname, email, alphanum) VALUES ('$fname', '$lname', '$email', 'random_string(10)')";
            $result = mysql_query($query) or die("Some kind of error occured.");

            echo ("Welcome " + $username + ", you are now in my database!");

}
else die("You did not fill out the fields correctly, please try again.");

?>

I need help with the line in the middle that starts with $query = "INSER ... 'random_string(10)')";

I need a random alphanumeric string to be inserted into the table called "customers" but instead of calling the function "random_string()" it inserts "random_string(10)" into my table which gives me this for my table with 6 fields:

5   John    Smith   Jogsz@CiniCraft.com random_string(10)   0

How do I fix this?

You shouldn't include the username and pass for your DB when you post questions — ohiock, Dec 31 '12 at 00:43
Compulsory comment - please use mysqli or pdo instead of mysql_* functions - they've been deprecated — Alfo, Dec 31 '12 at 00:47

score 3 · Answer 1 · answered Dec 31 '12 at 00:42

3

$query = "INSERT INTO customers (fname, lname, email, alphanum) VALUES ('$fname', '$lname', '$email', '" . random_string(10) . "')";

This should work! I think that even though double quotes will parse variables, they wont parse functions.

answered Dec 31 '12 at 00:42

Pankucins

1,690
1
16
25

score 2 · Accepted Answer · edited May 23 '17 at 12:18

concatenate the function and your string,

$query = "INSERT INTO customers (fname, lname, email, alphanum) VALUES ('$fname', '$lname', '$email', '" . random_string(10) ."')";

As a sidenote, the query is vulnerable with SQL Injection if the values of the variable came from the outside. Please take a look at the article below to learn how to prevent from it. By using PreparedStatements you can get rid of using single quotes around values.

How to prevent SQL injection in PHP?

score 0 · Answer 3 · answered Dec 31 '12 at 00:43

0

make two statements of it. In the first statement you call your function and assign the value to a variable and then in your INSERT... statement you use the variable

answered Dec 31 '12 at 00:43

agim

1,841
12
19

How to call a function/method in php to insert function return value to mysql

3 Answers3