0

If the POST value is not empty I want to do multiple insert to mysql table which has three values 1. id (auto increment) 2. name 3. workgroupId

$profileVal = $_POST['profileVal']; // insert 1 if value exist
    $projectVal = $_POST['projectVal']; // insert 2 if value exist
    $permitVal = $_POST['permitVal'];   // insert 3 if value exist
    $workgroupVal = $_POST['workgroupVal']; // insert 3 if value exist
    $uactivityVal = $_POST['uactivityVal']; // insert 3 if value exist
    $itemstatusVal = $_POST['itemstatusVal']; // insert 3 if value exist
    $projstatusVal = $_POST['projstatusVal']; // insert 3 if value exist
    $setupVal = $_POST['setupVal']; // insert 3 if value exist
    $xrefVal = $_POST['xrefVal']; // insert 3 if value exist
    $jobsVal = $_POST['jobsVal']; // insert 3 if value exist
    $searchVal = $_POST['searchVal']; // insert 3 if value exist
    $itemassortVal = $_POST['itemassortVal']; // insert 3 if value exist
    $sfilterVal = $_POST['sfilterVal'];// insert 3 if value exist
    $usersVal = $_POST['usersVal'];// insert 3 if value exist
    $wgId = $_POST['wgId']; // workgroupId repeats in each insert

if($profileVal!='' || $projectVal !='' || $permitVal!='' || $workgroupVal!='' || $uactivityVal!='' ||  $itemstatusVal!=''
|| $projstatusVal!='' || $loaditemsVal!='' || $setupVal != ''|| $xrefVal !='' || $jobsVal!='' ||  $searchVal != '' ||
$itemassortVal != '' || $sfilterVal!= '' || $usersVal !='' || $wgId!= '' ){
//my insert idea
$sql ="INSERT INTO  permit (id ,name ,workgroupId)
VALUES (NULL ,  $profileVal,  $wgId)
VALUES (NULL ,  $permitVal,  $wgId)";
}

// Is this the correct approach ? I will really appreciate if you can help

Shehary
  • 9,926
  • 10
  • 42
  • 71
amd
  • 113
  • 1
  • 1
  • 6
  • no. it's not. you have a gaping wide-open [sql injection attack](http://bobby-tables.com) vulnerability, sql syntax errors, and will get flooded with "undefined index" values if nothing was submitted. – Marc B Jul 10 '15 at 14:46
  • Could you please show me example how to do multiple inserts without having sql-injection vulnerability – amd Jul 10 '15 at 14:50
  • 1
    You have to use prepared statement (PDO) – Random Jul 10 '15 at 14:51
  • Use PDO or [other tools](http://stackoverflow.com/questions/129677/whats-the-best-method-for-sanitizing-user-input-with-php). Isset is your friend on POST entries – Answers_Seeker Jul 10 '15 at 15:00

0 Answers0