Best way to insert NULL into db

[Cups]

OK.

1. Call your form elements the same name as the database columns, its less confusing, not doing so does not protect your database in any way, and it opens up the way to think of your code as arrays.

2. Have an array of elements you expect to find coming from your form

3. Create the start and end of the sql query

4. Loop through the elements, check they are permitted, check they are valid, if so add then to a string, and add between the start and end of the sql query.

This is a simplified version with just 2 elements.

// 1

<form method=post action="">
<input type=hidden id="id" value=27>
<input id=keyword_one value="soup" />
<input id=url_one value="www.soup.com" />
<input type =submit></form>

<?php

// 2

$permitted = array(
  'keyword_one'
, 'url_one'
);

$_POST = array_map( "trim" ,  $_POST ) ;

if( isset( $_POST['id'] ) ) {

// 3

$sql_start = "update food set " ;
$sql_end = "where id = " . (int)$_POST['id']  ;
$sql _middle = "" ;

// 4

foreach( $_POST as $key=>$value ) {

// LOOK at the values if you are not sure, uncomment here
// echo $key . "=" . $value . PHP_EOL ;

   if( in_array( $key, $permitted ) && !empty( $value ) ) { // one security check 
 
         $sql_middle .= " $key = '" . mysql_real_escape_string( $value) . "'," ;

   }

}


// you have to chop off the , from the last element
$sql_middle = rtrim($sql_middle , "," )  ;

// you could test that $sql_middle is != ""

// then stick the bits back together, echo them out

echo $sql_start . $sql_middle . $sql_end ;

// copy and paste the outcome into PhpMyAdmin to 
// test it actually is well formed, and that you have 
// data in your database which permits the query to go ahead

}

That is untested by the way.

There are other things to be done, and I left it verbose so you can hopefully see what is going on and see what else has to be done like check there is more than just "id" set in the POST vars but this should give you an idea of how to build up the query string.

The key is to marry var names to column names, and start to think about your code as arrays as spelt out by this guy in loops are good