Adding value from dropdown or textfield to one database field

[gspabla]

Please have a look to the attachment to see what im trying to do.
Database field= "Age"
i want that if a user choose date of birth or if he writes his age in text box, the data goes to the fieldname 'Age ' only

how do i do this?

$insert = mysql_query("insert into register (Name,Gender,DOB,Age,TOB,POB) values ('".$_SESSION['Name']."', '".$_SESSION['Gender']."', '".$_SESSION['DateofBirth']."', '".$_SESSION['Age']."', '".$_SESSION['Timeofbirth']."', '".$_SESSION['Placeofbirth']."')

or die("Could not insert data because ".mysql_error()); 

im a newbie to php/mysql
please help!

[spiderling]

You must start your session. You also forgot the closing double quote at the end in your query. Where do your session values receive their values from? POST?
To avoid SQL injection you should mysql_real_escape_string in you query as well. See Example 3.

session_start();
$_SESSION['Name'] = $_POST['Name'];

$insert = mysql_query("INSERT INTO register (Name,Gender,DOB,Age,TOB,POB) VALUES ('".$_SESSION['Name']."', '".$_SESSION['Gender']."', '".$_SESSION['DateofBirth']."', '".$_SESSION['Age']."', '".$_SESSION['Timeofbirth']."', '".$_SESSION['Placeofbirth']."'")
or die("Could not insert data because ".mysql_error()); 

If you don't need the values after inserting, you could simply:

$Name = $_POST['Name']; 

and replace the $_SESSION with the variable name.

[SituationSoap]

You must start your session. You also forgot the closing double quote at the end in your query. Where do your session values receive their values from? POST?
To avoid SQL injection you should mysql_real_escape_string in you query as well. See Example 3.

If you want to avoid SQL injection, you should used Parametrized SQL, not string escaping (Well, you should validate your input, amongst which string escaping is useful). It is impossible to inject against a parametrized query. History has shown that escaping strings isn't always as effective.

</rant>

[spiderling]

Thanks for the info.

Isn't using sprintf() with mysql_real_escape_string() another form of a parameterized statement as it uses a placeholder, as well as a type specifier and escapes?

[AnthonySterling]

Thanks for the info.

Isn't using sprintf() with mysql_real_escape_string() another form of a parameterized statement as it uses a placeholder, as well as a type specifier and escapes?

Afraid not, the only thing sprintf does is make concatenating queries easy to read, it offers zero protection.

[spiderling]

Is this an ideal example then?

$db = new mysqli("localhost", "user", "pass", "database");
$stmt = $db -> prepare("SELECT priv FROM testUsers WHERE username=? AND password=?");
$stmt -> bind_param("ss", $user, $pass);
$stmt -> execute(); 

Does the bind_param itself prevent issues with the user's input or is validation / "filtering" still necessary? I wouldn't feel right not validating / filtering, that's for sure.

[AnthonySterling]

Validation and filtering protects your application, bound parameters and the like protect your database should something get through your validation and filtering.

It's not and either/or decision.

[spiderling]

Thanks!