You realize you’re going to get a deluge of people hammering you about NEVER inserting unsanitized data into your query, right? PDO and parameterized queries are much safer and you should REALLY look into getting into the habit of using those methods all the time.
That being said, the quick and dirty answer would be to not reference those fields if they’re null
Array
(
[beginning_slot] => 0
[ending_slot] => 6
[beginning_x] =>
[width] =>
[orientation] => 1
[device] => 4u
[rack_id] => 43
)
ERROR: Could not execute INSERT INTO devices ( rack_id,orientation,beginning_slot,ending_slot,device, width, beginning_x) VALUES (43,1,0,6,'4u',,). You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ')' at line 1
I thought those if statements would get rid of the last 2 fields and values since they are no set so I wouldn’t have them in the query?
If I need to put a value in there, how do I put in NULL instead of nothing?
It’s not the extension that you use that determines if something is secure or not, it’s how you use that extension. It’s just as wasy to make code this vulnerable in PDO as well.
Prepared statements may be used in either mysqli or PDO. Using placeholders may even fix the issue with blank values (*though I’m not certain of that).
Array
(
[beginning_slot] => 4
[ending_slot] => 7
[beginning_x] =>
[width] =>
[orientation] => 1
[device] => D Panel
[rack_id] => 44
)
ERROR: Could not execute INSERT INTO devices ( rack_id,orientation,beginning_slot,ending_slot,device, width, beginning_x) VALUES (44,1,4,7,'D Panel',,). You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ')' at line 1
since both the width and beginning_x values have nothing in them, shouldn’t both if statements change both variables in the INSERT to get rid of , width, beginning_x in he field part and those two ,s in the values part? Isn’t that what empty() tests for?
