If a value isn't set or is empty...?

Say I have a file to add data to a database, so it goes something like this:

if(isset($_POST['submit']))
{
	$1 = $_POST['value1'];
	$2 = $_POST['value2'];
           and so on for about 15 values in total
	
	$query = " INSERT INTO blah (value1, value2, etc) VALUES ('$1','$2',etc)";
	mysql_query($query) or die('Error ,query failed');
}

Code (markup):

Say if value 1 is not found in post, or it is empty what will happen? Will it stop execution of the script? Or will it just skip over it?

I'd assume it does the latter, but I thought it was best to ask you guys first .

Thanks,
TS

 

well if its not found or empty it will just be and empty string

 

Okay, thats fine then. Thats what I wanted to hear.

Thanks

 

It mostly depends upon the way you code , you have coded correctly so it would skip , just empty value will be added into database (also consider how your database table is structured , ie it allows empty values for that field)

and if you have coded something like the following , it would give mysql error if $a is empty :

if(isset($_POST['submit']))
{
	$a = $_POST['value1'];
	$b = $_POST['value2'];
           and so on for about 15 values in total
	
	$query = " INSERT INTO blah (value1, value2, etc) VALUES ($a,'$b',etc)";
	mysql_query($query) or die('Error ,query failed');
}

PHP:

see i have remove the quotes on the first variable.


P.S. Remember that php does not support variables starting from numbers , $1 , $2 is wrong.

cheers!
sarav
http://www.urlsave.net

 

Yeah I see what you have done there, and see why it would give an error.
Good to know i'm coding well then

I know $1, $2, etc would be wrong, was just using it as an example, wasn't thinking there

 

Unless you set the DB fields to NULL instead of NOT NULL, then use empty() instead of isset() to avoid errors.

     if (empty($_POST['value'])) {
          $value = '';
     } else {
          $value = mysql_real_escape_string(htmlentities(strip_tags($_POST['value'])));
     }
     // mysql query here.

PHP:

 

Putting input data directly into mySQL without serious filtering is VERY dangerous.

As well, on some servers, using an unassigned POST or GET variable could give you a warning/error message.

In your example, try this:

$1=( isset($_POST['value1']) ? $_POST['value1'] : "" );

and optionally

$1=trim($1);

... which will take care of the unassigned variable, then

$1=mysql_escape_string($1);

before the mysql statement to make the db call safer.