SQL validation!

Question

I am pretty new in SQL so this may be a stupid question...

I have a form in PHP which fills in few fields in my SQL table. I have this code:

$sql="INSERT INTO $tbl_name
(app_name, app_path, short_desc, full_desc)
VALUES ('$_POST[app_name]', '$_POST[app_path]',
'$_POST[short_desc]', '$_POST[full_desc]')";

But even app_name and app_path are NOT NULL columns, the query can be executed if there is no text in these fields in the form.

So, my question is:

How to stop the execution of the query if there is no text in the NOT NULL fields ?

Answer 1

if ($app_name != "" && $app_path != "")
    $sql="INSERT INTO $tbl_name (app_name, app_path, short_desc, full_desc) VALUES ('$_POST[app_name]', '$_POST[app_path]', '$_POST[short_desc]', '$_POST[full_desc]')";
else { /* do something */ }

Use mysql_real_escape_string() to sanitize the input before running the insertion query.

Answer 2

You can test the values before trying to execute the query:

if (empty($_POST['app_path']))
{
    // Error.
}

Note also that your code could be vulnerable to SQL injection attacks. You could use mysql_real_escape_string to protect yourself against this attack:

$sql= sprintf("INSERT INTO $tbl_name
               (app_name, app_path, short_desc, full_desc)
               VALUES ('%s', '%s', '%s', '%s')",
               mysql_real_escape_string($_POST['app_name']),
               mysql_real_escape_string($_POST['app_path']),
               mysql_real_escape_string($_POST['short_desc']),
               mysql_real_escape_string($_POST['app_full_desc']));

Answer 3

Btw, empty string and NULL is not the same thing. http://dev.mysql.com/doc/refman/5.0/en/working-with-null.html

And validate variables before execute the query.

Answer 4

Please do not do it like this, you are writing code with SQL injection vulnerabilities. You are also making programming fairies die.

Look into Prepared statements. After that, take the advice in other answers here on checking the values first.

Answer 5

They are probably blanks/empty strings, an empty string is not the same as NULL

but you have bigger problems here, your code is vulnerable to SQL Injection

Answer 6

Empty strings are not null, so nothing bad would happen even if you did insert that. However, if you really want to abort, then Same as @Jan's solution, however I can't upvote it because he didn't correct you on a very important point having to do with escaping user's strings and SQL injection attacks.

UPDATE now he did :) Anyway, see? Ask one question, get another much more valuable one answered by everybody! :)