Concatenate $i to end of a variable name

Question

I'm trying to make it so that each time I loops through, the SQL statement changes to reflect the value of I as well. For example, if there are two rows, I want it to execute an SQL statement with the variables product1, quantity1, unit1 and also for the variable proudct2,quantity2,unit2.

Unfortunately, all it does is evaluate the same sql statement twice. How do I go about fixing it?? Thanks

for ($i = 1;$i=$numrows; $i++) {
     $sql= "INSERT INTO orderItem(order_id,item_linenum,product_id,item_quantity,item_unitprice)
          VALUES(".$_REQUEST["orderNumber"]."$i,'".$_REQUEST["product".$i]."','".$_REQUEST['quantity'.$i]."'," .$_REQUEST['unit'.$i].")";
    print "*" . $sql. "*" . "<br/>";
    $result= mysqli_query($db, $sql) or die("SQL error: " . mysqli_error());
}

Your code is vulnerable to [SQL Injection](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) — Machavity, Nov 18 '15 at 04:24
*INSERT INTO orderItem(order_id,item_linenum,product_id,item_quantity,item_unitprice) VALUES (1102,2,'BC501','1',200)* *INSERT INTO orderItem(order_id,item_linenum,product_id,item_quantity,item_unitprice) VALUES (1102,2,'BC501','1',200)* — Raluca Avram, Nov 18 '15 at 04:25

score 0 · Accepted Answer · answered Nov 18 '15 at 04:25

0

Change this,

for ($i = 1;$i <= $numrows; $i++) {
               ^

answered Nov 18 '15 at 04:25

Niranjan N Raju

12,047
4
22
41

Concatenate $i to end of a variable name

1 Answers1