Multiple add in multiple sql request?

Question

I want to add multiple line in my database in the same time with one form, but my success for each sql request is false, i dont know what to do :(

Its for Charts.js, i need to put each time the year(annee), the amout(montant) and the name of the compagny(societe).

Each line of my database look like : ID | societe | annee | montant

My form :

<form action="ca/ajout-ca.php" method="post" enctype="multipart/form-data"> 
     <h3>ANNÉE</h3>
     <div class="form-group">
            <label for="annee"></label>
            <input type="text" name="annee" id="annee" class="form-control" />
        </div>   
        <h4>GROUPE</h4>
        <div class="form-group">
            <label for="montant_groupe"></label>
            <input type="text" name="montant_groupe" id="montant_groupe" class="form-control" />
        </div>                          
        <br>
        <h4>APRIME</h4>
         <div class="form-group">
            <label for="montant_aprime"></label>
            <input type="text" name="montant_aprime" id="montant_aprime" class="form-control" />
        </div>                          
        <br>
        <h4>ENTI</h4>
        <div class="form-group">
            <label for="montant_enti"></label>
            <input type="text" name="montant_enti" id="montant_enti" class="form-control" />
        </div>                          
        <br>
        <h4>S2MI</h4>
        <div class="form-group">
            <label for="s2mi"></label>
            <input type="text" name="montant_s2mi" id="montant_s2mi" class="form-control" />
        </div>                          
        <br>
        <h4>JBM41</h4>
        <div class="form-group">
            <label for="montant_s2mi"></label>
            <input type="text" name="montant_s2mi" id="montant_s2mi" class="form-control" />
        </div>                          
        <br>
        <button type="submit" class="btn btn-primary">Valider</button>
    </form>

My Add sql file

<?php
require_once('../connexion.php');

$return = array('success' => false);
$return1 = array('success' => false);
$return2 = array('success' => false);
$return3 = array('success' => false);
$return4 = array('success' => false);


$annee            = isset($_POST['annee']) ? $_POST['annee'] : null;
$montant_groupe    = isset($_POST['montant_groupe']) ? $_POST['montant_groupe'] : null;
$montant_aprime    = isset($_POST['montant_aprime']) ? $_POST['montant_aprime'] : null;
$montant_enti    = isset($_POST['montant_enti']) ? $_POST['montant_enti'] : null;
$montant_s2mi    = isset($_POST['montant_s2mi']) ? $_POST['montant_s2mi'] : null;
$montant_jbm41    = isset($_POST['montant_jbm41']) ? $_POST['montant_jbm41'] : null;

var_dump($_POST);

if(!is_null($annee) && !is_null($montant_groupe) &&     !is_null($montant_aprime) && !is_null($montant_enti) && !is_null($montant_s2mi)     && !is_null($montant_jbm41)){

$sql = "INSERT INTO ca SET annee = '$annee', montant = '$montant_groupe', societe = 'groupe'";
                $return['success'] = $connexion->exec($sql);

$sql1 = "INSERT INTO ca SET annee = '$annee', montant = '$montant_aprime', societe = 'aprime'";
                $return1['success'] = $connexion->exec($sql1);

$sql2 = "INSERT INTO ca SET annee = '$annee', montant = '$montant_enti', societe = 'enti'";
                $return2['success'] = $connexion->exec($sql2);

$sql3 = "INSERT INTO ca SET annee = '$annee', montant = '$montant_s2mi', societe = 's2mi'";
                $return3['success'] = $connexion->exec($sql3);

$sql4 = "INSERT INTO ca SET annee = '$annee', montant = '$montant_jbm41', societe = 'jbm41'";
                $return4['success'] = $connexion->exec($sql4);
}  

echo json_encode($return);
echo json_encode($return1);
echo json_encode($return2);
echo json_encode($return3);
echo json_encode($return4);
/*
header('Location: ../admin_ca.php');*/

my $return(number) return me false at each line and the result of my vardump is good, it record my number of the form

Thanks for helping guys !

first things first, you need to fix the code in `$sql = 'INSERT INTO ca SET annee = \'' . $annee . '\', montant = \'' . $montant_groupe . '\', societe = \''groupe\'';` to `... \'groupe\''`. Then that would be useful to show the content of `connexion.php` before further advise. — , May 17 '16 at 09:43
You are making your like difficult with all that single quoted literal and escaping stuff. Look up `variable expansion` in Double Quoted Strings `$sql = "INSERT INTO ca SET annee = '$annee', montant = '$montant_groupe', societe = 'groupe'";` — RiggsFolly, May 17 '16 at 09:45
You should really be using parameterized queries if you are using un-trusted data from the $_POST array to avoid [SQL Injection Attack](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) — RiggsFolly, May 17 '16 at 09:51
Ty @RiggsFolly, that's a way better and simple with double quotes, i dont think i need to secure my sql cause this is for the backoffice, i will do if i got time, ty for the link — AlexDemzz, May 17 '16 at 09:59
Just for reference: ___More hacks are done by INTERNAL staff, or with the HELP OF INTERNAL staff than any other way___ They are the **first people** you should be protecting your system from, not the last! — RiggsFolly, May 17 '16 at 10:08

score 0 · Accepted Answer · answered May 17 '16 at 10:32

0

I found the problem, i've do a mistake in my form i put 2 type the same name "montant_s2mi" instead of "montant_s2mi" and "montant_jbm41"

So when my if (!is_null) start my "montant_jbm41" was null, and my if cant enter in the sql request.

answered May 17 '16 at 10:32

AlexDemzz

243
2
18

Multiple add in multiple sql request?

1 Answers1