ansaurus

Question

Answer 1

+3 A:

Firstly, all of your <input type="checkbox"> fields have the same name attribute. This results in several values with the same name being sent over (if several checkboxes are checked), of which PHP only uses the last one for its $_POST collection.

To solve this, give them the name "choice[]", instead of "choice". This signals PHP that there are several values possible, and they will be all available as an array. In other words, you will be able to do the following:

$choices = $_POST['choice'];
foreach ( $choices as $key => $value )
    echo "$key  => $value";

And this will output something like

0 => 32
1 => 12
2 => 48

In other words - you get an array with the values of the checked checkboxes. After that you can do what you like with them. For example, implode() them to get a comma-separated list.

One thing that you should be warned about though. It's called "SQL Injection" and is a common mistake of inexperienced programmers. The idea is that a malicious user can easily send other values there too, not only the ones you have specified in your HTML. It does not take much skill to forge a HTTP request. There can be ANYTHING coming from the user, so you should ALWAYS check ALL INPUT that you get from the user. Don't trust any JavaScript validations you make. As long as it's from the user side - it cannot be trusted. Ever.

And if you are wondering how that can be a bad thing - consider, what would happen if suddenly one of the values in your array wouldn't be 43 anymore, but instead would be "'); DROP DATABASE; --".

Since you are blindly executing a query like

INSERT INTO options VALUES('$opt');

This would then turn into

INSERT INTO options VALUES(''); DROP DATABASE; --);

And bye-bye goes your database. Thus, ALWAYS make sure that the user input is what you expect it to be and that there is no possiblity for something like this. Oh, and yes - addslashes() is not a good method because there is still a way around that. Parametrized queries are the best way to go, but if you can't use that then at least use mysql_real_escape_string() for MySQL, or whatever else your DBMS offers.

Vilx- 2009-01-01 22:43:22

Answer 2

A:

See my answer here

Click Upvote 2009-01-03 11:32:28

ansaurus

tags:

views:

answers:

Help with checkbox and database

related questions