mysqli_real_escape_string for int

Question

Help, I've been searching for all solutions on how I can retrieve my data from a table in a database using the primary key.

intval($referenceNumber) = mysqli_real_escape_string($link, $_POST['referenceNumber']);

Then my sql query goes like this..

$sql = "INSERT INTO cleared 
        (referenceNumber, visitorName, visitorID, 
        numberOfCompanions, collegeVisit, reasonVisit, timeIn)
        SELECT *
        FROM visitor
        WHERE referenceNumber = PRIMARY KEY";`

I always get the error: Fatal error: Can't use function return value in write context in C:\wamp64\www\test\transfer.php on line 13

How can I remove this error? Thanks in advance for the help.

`$referenceNumber = intval(mysqli_real_escape_string($link, $_POST['referenceNumber']));` — RiggsFolly, Feb 16 '18 at 11:27
If you are using `mysqli_real_escape_string()` then I assume you are not using prepared bound queries and therefore you are open to [SQL Injection Attack](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) Even [if you are escaping inputs, its not safe!](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) Use [prepared parameterized statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) — RiggsFolly, Feb 16 '18 at 11:28
Thank you for the help! @RiggsFolly. Line 13 is exactly the error you corrected, but another error popped which says, "Undefined index: referenceNumber in C:\wamp64\www\test\transfer.php on line 13" — Marc Lim, Feb 16 '18 at 11:36
Then you need to check that the `` has that name, just an `id="referenceNumber"` will not work it must have a `name=""` name — RiggsFolly, Feb 16 '18 at 11:55

score 0 · Answer 1 · answered Feb 18 '18 at 05:08

Well you need to first assign the value to the variables and then cast it to an integer. You line 13 should be:

$referenceNumber = mysqli_real_escape_string($link, $_POST['referenceNumber']);

$referenceNumber = intval($referenceNumber);

See the documentation for intval

mysqli_real_escape_string for int

1 Answers1