Converting a SQL Select Statement into a Php Variable

Question

I am trying to convert a SQL select statement into a useable PHP Variable which will be submitted to my database. I am trying to turn the $getQuizIDQuery into a $classID variable. Any help & advice is much appreciated. Thanks

Note: The checkbox code is for a piece of PHP code below what is shown

<?php
if (isset($_POST['submit'])) {
//Get POST variables
$quizTitle = '"' . $mysqli->real_escape_string($_POST['quizTitle']) . '"';
$description = '"' . $mysqli->real_escape_string($_POST['description']) . '"';
//echo $quizTitle;
//echo $description;

//Question query
$quizCreationQuery = "INSERT INTO quiz (quizTitle, description) VALUES($quizTitle, $description)";

//Run Query
$insert_row = $mysqli->query($quizCreationQuery) or die($mysqli->error . __LINE__);


$getQuizIDQuery = "SELECT quizID FROM quiz ORDER BY quizID DESC LIMIT 1";
mysqli_query($mysqli, $getQuizIDQuery) or die ('Error getting Quiz ID');

$result = mysqli_query($mysqli, $getQuizIDQuery);


foreach ($_POST['check_box'] as $classID) {

$ClassQuizQuery = "INSERT INTO quiz_class(classID, quizID) VALUES('$result', 
'$classID')";

$insert_ClassQuiz = $mysqli->query($ClassQuizQuery) or die($mysqli->error . __LINE__);
 }
 }

http://php.net/manual/en/mysqli.quickstart.prepared-statements.php — AbraCadaver, Apr 30 '18 at 19:14
I know the code is susceptible to SQL injection, planning on sorting that out once I have the the functionality of everything complete. Thanks — prototype., Apr 30 '18 at 19:17
Welcome to stackoverflow! This is an excellent question. You are asking very important querstions. The consensus now regarding SQL is that you should use prepared statements, and at all costs should avoid using escape methods to build SQL strings. I think you will find some good answers here: https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php?rq=1 — Arend, Apr 30 '18 at 19:17

Arend · Answer 1 · 2018-04-30T19:24:08.930

0

After inserting your query, you can fetch the id of the inserted record using

So you could replace

$getQuizIDQuery = "SELECT quizID FROM quiz ORDER BY quizID DESC LIMIT 1";
mysqli_query($mysqli, $getQuizIDQuery) or die ('Error getting Quiz ID');
$result = mysqli_query($mysqli, $getQuizIDQuery);

with:

$insertedQuizId = $mysqli->insert_id insert_id will contain the primary key of the last inserted record.

edited Apr 30 '18 at 19:24

answered Apr 30 '18 at 19:19

Arend

3,741
2
27
37

Sorry I am not sure of what you are saying, Do you mean that I can get the QuizID without having to do the select statement? – prototype. Apr 30 '18 at 19:21
Ok, I will try this. How do i turn the $insertedQuizID into the $quizID variable I am looking to achieve? Thanks – prototype. Apr 30 '18 at 19:25
I'm not sure I understand your question. There are several variables named quizID, which one are you refering to? – Arend Apr 30 '18 at 19:27
Sorry I will explain a bit better, I have a table called Quiz_Class with fields QuizID and ClassID. I am looking to post the $QuizID variable to this table – prototype. Apr 30 '18 at 19:31
Sure, you can just use the $insertedQuizId for that. – Arend Apr 30 '18 at 20:01

Converting a SQL Select Statement into a Php Variable

1 Answers1