Deny insert when column value is empty

Question

I have my php code that will hold and insert date to mysql:

from an input textbox

$id2 = $_POST['id'];

Random Number Generator How can I generate it always on 5 digit?

$random = rand();

Insert code:

$sql3="Insert into warranty(serial_no,a_id)
values ('$random','$id2')";
$result3=mysql_query($sql3);

How can I deny insert when $id2 doesn't have a value?

You are vulnerable to SQL injection and are [using a deprecated library](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php) — George, Feb 14 '14 at 11:33

score 3 · Answer 1 · edited May 23 '17 at 12:29

3

Just use empty() function to determine, if given variable has value or not (manual page). Like this:

if (!empty($id2))
{
   $sql3="Insert into warranty(serial_no,a_id) values ('$random','$id2')";
   $result3=mysql_query($sql3);
}

But passing $_POST value directly to SQL query is huge* security issue (SQL Injection to be clear), os use at least mysql_real_escape_string():

$sql3="Insert into warranty(serial_no,a_id) values ('$random','" . mysql_real_escape_string($id2) . "')";

For more info about this, read How can I prevent SQL injection in PHP?.

EDIT: At first, I miss your second question, so moved from comments - to generate 5 digits random number, use simple:

$fiveDigitsRand = rand(10000, 99999);

edited May 23 '17 at 12:29

Community

1
1

answered Feb 14 '14 at 11:32

Pavel Štěrba

2,822
2
28
50

how can I generate random numbers always on 5 digits sir? – user3117337 Feb 14 '14 at 11:44
Simply with `rand(10000, 99999);` – Pavel Štěrba Feb 14 '14 at 11:46

score 1 · Answer 2 · answered Feb 14 '14 at 13:29

put below code and remove existing code.You don't have need of $id2 variable if you are getting value using $_POST method. You can do it directly by following code.

$random = rand();

if(isset($_POST['id']))
{   
$sql3="Insert into warranty(serial_no,a_id)
values ('$random','".$_POST['id']."')";
$result3=mysql_query($sql3);
}
else
{
echo "No ID Found"; //you can do any action here.
}

score 0 · Answer 3 · answered Feb 14 '14 at 12:16

0

$random = rand(10000,99999);

if(!empty(trim($id2)))

{
  $sql3="Insert into warranty(serial_no,a_id) values ('$random','$id2')";
 $result3=mysql_query($sql3);
}

answered Feb 14 '14 at 12:16

Pinu

382
3
4

score -1 · Answer 4 · answered Feb 14 '14 at 11:33

-1

if(isset($id2))
{
$sql3="Insert into warranty(serial_no,a_id)
values ('$random','$id2')";
$result3=mysql_query($sql3);
}

answered Feb 14 '14 at 11:33

Jenz

8,280
7
44
77

iseet() tells him only if given variable is set, not if has some value. Empty is better here. – Pavel Štěrba Feb 14 '14 at 11:38

Deny insert when column value is empty

4 Answers4