PHP script that inserts url variables into mysql db?
I am looking for a simple and safe script to insert rows into a mysql table from a PHP script.
by calling http://www.myserver.com/addtosometable.php?1=asdf&2=asdf ....
I am not asking how specifically, rather I thought it might be a good platform to build an example script and keep it up to date with best practices ...
Greetings
a source to share
all URL variables (GET variables) are put into a PHP variable $_GET
as an array.
Using your example above myfile.php?1=asdf&2=asdf
, your script will access an array that looks like this:
array(
1 => "asdf"
2 => "asdf"
)
If you want to see it for yourself, just put this in your file:
print_r($_GET);
From there, there should be a simple task of clearing variables to avoid attack attacks and then creating an INSERT statement. I will need to know more about your table structure and what you need specifically for this. See the docs on mysql_real_escape_string .
a source to share
If you are using MySQL 5, you can use prepared statements to avoid most forms of SQL Injection.
$ stmt = $ db-> prepare ("INSERT INTO table (col1, col2) values (?,?);
// check for errors
$ result = $ stmt-> execute ($ _GET ['1'], $ _GET ['2']);
// check for errors
I believe you still have to worry about XSS (Cross-Site-Scripting) attacks, but that's outside of my ken.
a source to share