PHP posting a variable in a variable using mysql

Question

I need to use the number of the district to be the tail end of my variable. Example $publish_page_ADD THE DISTRICT NUMBER I am grabbing the $district_num from my url which I've verified with echo

Here is what I've tried

$district_num = $_REQUEST['district_num']; // from url and works

$publish_page_.''.$district_num = $district_var['publish_page_'.$district_num.'']; //this does not work

$publish_page_.''.$district_num = addslashes($_POST['publish_page_'.$district_num.'']); //this does not work

$sql = "UPDATE districts SET
        publish_page_$district_num = '$publish_page_$district_num' //this does not work and throws error "can not find publish_page_ in field list

        WHERE district_num ='$district_num'"; //this works when the above code is removed

Follow up on corrected code... Thank You @cale_b and @Bill Karwin

     $district_num = (int) $_REQUEST['district_num']; 
     $$publish_page = "publish_page_{$district_num}";

     $$publish_page = $district_var[ "publish_page_{$district_num}"];

if (isset($_POST['submitok'])):
   $$publish_page = addslashes($_POST[$publish_page]);


    $sql = "UPDATE districts SET
            publish_page_{$district_num} = '$publish_page'

        WHERE district_num ='$district_num'";

What's more useful is examples of inputs and outputs. Your question is a bit confusing. However, you're looking for two concepts: 1: variable variables and 2: interpolation - try this out for your second line: $key = "publish_page_{$district_num}"; then $$key = $district_var[ "publish_page_4_{$district_num}"]; - (yes, $$key - that's a variable variable) — random_user_name
– random_user_name, Commented Oct 17, 2017 at 22:11

Bill Karwin · Accepted Answer · 2017-10-17 22:23:36Z

2

If you want to learn about PHP's variable variables, it's in the manual (I linked to it). But you actually don't need it in your case.

Be careful about SQL injection. Your code is vulnerable to it.

Since you're using input to form a SQL column name, you can't use SQL query parameters to solve it. But you can cast the input to an integer, which will protect against SQL injection in this case.

$district_num = (int) $_REQUEST['district_num'];

$publish_page_col = "publish_page_{$district_num}";

The above is safe because the (int) casting makes sure the num variable is only numeric. It isn't possible for it to contain any characters like ' or \ that could cause an SQL injection vulnerability.

For the other dynamic values, use query parameters.

$publish_page_value = $_REQUEST["publish_page_4{$district_num}"];

$sql = "UPDATE districts SET
        `$publish_page_col` = ?
        WHERE district_num = ?";
$stmt = $pdo->prepare($sql);
$stmt->execute([ $publish_page_value, $district_num ]);

As @cale_b comments below, you should understand that in PHP, variables can be expanded inside double-quoted strings. See http://php.net/manual/en/language.types.string.php#language.types.string.parsing for details on that.

edited Oct 17, 2017 at 22:23

answered Oct 17, 2017 at 22:16

Bill Karwin

567k87 gold badges711 silver badges872 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

random_user_name Over a year ago

You might mention the importance of the double-quotes and the fact that interpolation is happening within them....

iconMatrix Over a year ago

When echoing the below code the text is lost and only the number is displayed. $district_num = (int) $_REQUEST['district_num']; $publish_page_col = "publish_page_{$district_num}";

Bill Karwin Over a year ago

It works fine for me. I can var_dump($publish_page_col); and the output is string(17) "publish_page_1234". I have no idea what you're doing.

Collectives™ on Stack Overflow

PHP posting a variable in a variable using mysql

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related