Smarter way to extract data from FORM and save to DB?

[Gilles Ganault]

Hello

Out of curiosity, is there a smarter, easier way to read data sent by
a form, and save them into a database? I have about 20 fields, and
it'd be easier if I could just use a loop to go through an array and
generate the SQL query in a couple of lines:

======
//If 'id' set -update; Otherwise -insert
if($_POST['id'])
$sql = sprintf("UPDATE $table SET name='%s', tel='%s' WHERE
id=%s",$_POST['name'],$_POST['tel'],$_POST['id']);
else
$sql = sprintf("INSERT INTO $table (id,name,tel) VALUES
(NULL,'%s','%s' )",$_POST['name'],$_POST['tel']);
======

Thank you.

[Michael Fesser]

..oO(Gilles Ganault)

>On Fri, 08 Feb 2008 09:33:01 GMT, "rf" <[e-mail] wrote:

>>Never heard of sql injection then?
With the above I could drop your entire database :-)

I did hear, but wasn't paying attention because I first have to get
this CRUD thingie running ;-) Besides, although the web server will be
accessible from the Net, 1) it won't be published, meaning that if you
don't know the URL, there's no way to know it's there

You shouldn't rely on that. There's a couple of ways how such a "hidden"
might leak (proxys, server logs, referrer, ...). It's just a matter of
them when someone will find it one way or another.

>and 2) I'll add
an .htaccess to prompt users for a login before they have access to
it.

Slightly better, but still allows the users to have some fun with your
database and perform unwanted actions.

>But I'll read up on SQL injections because it looks nasty enough.

That's the correct way. SQL injection is a serious issue and must be
fixed. It really helps to use prepared statements for example.

Micha