Saving Backbone JSON object to MySQL table with PHP

Question

I'm saving Backbone model data, which POSTs a JSON object to my save.php file. As the model data will be for my application's users, I'd like to store unique values in a MySQL table.

Currently, I'm using this method:

$values = json_decode(file_get_contents('php://input'), true);
$name = $values["name"];

$sql="INSERT INTO `users` (name) VALUES $name";

It's giving me this error

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'John Doe' at line 1

If I pass a simple string in the query, it works the way I'd like:

$sql="INSERT INTO `users` (name) VALUES ('John Doe')";

My questions are:

Why is $name not a string?
Is this the best way to insert a JSON object into a MySQL table?

Thank you!

Always use prepared/parameterized queries! You may be opening yourself to SQL injection attacks, and it's likely that your value for $name is the problem anyway. — Brad
– Brad, Commented Jun 10, 2013 at 1:00
I'm not sure how to use prepared/parameterized queries. I'll look into it. — Dr. Pontchartrain
– Dr. Pontchartrain, Commented Jun 10, 2013 at 1:04

nikoshr · Accepted Answer · 2013-06-10 07:38:16Z

1

JSON is just a representation of your data : once decoded $values["name"] contains a string with your value, John Doe. This means that, as is, your request expands to

$sql="INSERT INTO `users` (name) VALUES John Doe";

which is both an invalid syntax and very insecure.

Use the PDO class wherever you can, something like this :

$sql = "INSERT INTO users (name) VALUES(?)";
$sth = $dbh->prepare($sql);
$sth->execute(array(
    $name
));

answered Jun 10, 2013 at 7:38

nikoshr

33.4k34 gold badges95 silver badges112 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Saving Backbone JSON object to MySQL table with PHP

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related