CODEWITHSUNDEEP
phpmysql
Ok-Alex
Ok-Alex

Reputation: 558

MySQL query php variable in variable?

I have a PHP function that makes a query to MySQL DB.

function regEvent($event, $l)
{
$sqlz_upd="UPDATE {$event} SET f1a='$_POST[F1A"'.$l.'"]'";

The question is what is the syntax to use variable $l in $_POST[F1A$l]?

Upvotes: 2

Views: 167

Answers (3)

Marius Solbakken Mellum
Marius Solbakken Mellum

Reputation: 736

Here you go:

$var = mysql_real_escape_string($_POST["F1A".$l]);
$sqlz_upd="UPDATE {$event} SET f1a='$var' ";

Upvotes: 1

SuVeRa
SuVeRa

Reputation: 2904

if you are using a string as key in an associative array. It should be enclosed in single or double quotes(though PHP won't give any error).

i.e. $_POST['F1A'. $l] or $_POST["F1A$l"]

my suggestion will be...

$sqlz_upd="UPDATE {$event} SET f1a='" . $_POST["F1A$l"] . "'";

Upvotes: 1

Patrick Desjardins
Patrick Desjardins

Reputation: 140753

$condition = $_POST["F1A" . $l];
$sqlz_upd="UPDATE {$event} SET f1a='".mysql_real_escape_string($condition)."'";

This is how to use your dynamic post and be safe for Sql Injection.

Upvotes: 4

Related Questions