Quick PHP / Mysql question - GoFuckYourself.com

mkx · 12-16-2009, 12:04 PM

I am trying to insert the $array[14] result into my mysql database but it is just inserting $array[14] in plain text instead of the variable.

Code:

<?php
include 'dbconnect.php';

$query  = "SELECT * FROM messages WHERE id=43";
$result = mysql_query($query);


while($row = mysql_fetch_array($result))
  {
  $str = $row['message'];
  }


$arrays = (explode(",\"",$str)); //seperates anything with ,"
$arrays = (explode("\"",$str)); //reseperates anything with "


echo $arrays[14]; //prints result 14


mysql_select_db($mysql);
$query = 'INSERT INTO `sms`.`redirects` (`id`, `msg`, `from_num`, `to_num`, `from_country`, `to_country`, `status2`, `time_created`) VALUES (NULL, \'apples\', \'peanuts\', \'$arrays[14]\', \'\', \'\', \'\', \'\');';

mysql_query($query) or die('Error, insert query failed');

$query = "FLUSH PRIVILEGES";
mysql_query($query) or die('Error, insert query failed');

?>

I tried
uts\', \'"$arrays[14]"\', \'
uts\', \'echo $arrays[14]\', \'
uts\', \'".$arrays[14]."', \'

and a few other variations but it just gave a http 500 error or inserted it in plain text.

Incase your wondering about the weird insert command and all the unnecessary back slashes, I got the code from inserting manually into the mysql database and hitting create php code since nothing else was really working.

grumpy · 12-16-2009, 12:09 PM

try this

Code:

$query = 'INSERT INTO `sms`.`redirects` (`id`, `msg`, `from_num`, `to_num`, `from_country`, `to_country`, `status2`, `time_created`) VALUES (NULL, \'apples\', \'peanuts\', \'".$arrays[14]."\', \'\', \'\', \'\', \'\');';

Fuckin Bill · 12-16-2009, 12:11 PM

You have to enclose an array in curly brackets.

\'{$array[14]}\'

You should also use double quotes around the query, then you won't have to escape every single quote in the line.

mkx · 12-16-2009, 12:27 PM

hmm both suggestions just insert the plain text into the to_num field

".$arrays[14]."
and
{$arrays[14]}

I tried doing it with double quotes before but it kept screwing up so I am just copying it from the create php code option in phpmyadmin.

mkx · 12-16-2009, 01:17 PM

boo ya ka cha

Code:

mysql_select_db($mysql);
$query = "INSERT INTO `sms`.`redirects` (`id`, `msg`, `from_num`, `to_num`, `from_country`, `to_country`, `status2`, `time_created`) VALUES (NULL, 'apples', 'peanuts', '".$arrays[14]."', 'pizza', '', '', '')";

borked · 12-16-2009, 01:21 PM

single and double quotes.... you're getting all mixed up and confused...

run this script and see for yourself where your problem lies....

Code:

<?php

$array[5] = 'single quote';
$array[6] = 'double quote';

echo 'This is an echo from within a {$array[5]} <br>';
echo "This is an echo from within a {$array[6]} <br>";

?>

Bird · 12-16-2009, 01:23 PM

Yes single quotes means literal so if you have '.$string.' the out put will be .$string. With double quotes ".$string." the output would be whatever $string = to

JarvisEncoding · 12-16-2009, 08:59 PM

Quote:

Originally Posted by borked

single and double quotes.... you're getting all mixed up and confused...

run this script and see for yourself where your problem lies....

Code:

<?php

$array[5] = 'single quote';
$array[6] = 'double quote';

echo 'This is an echo from within a {$array[5]} <br>';
echo "This is an echo from within a {$array[6]} <br>";

?>

Agreed. This is the best way from my neighbour.

JarvisEncoding · 12-16-2009, 09:05 PM

Quote:

Originally Posted by Bird

Yes single quotes means literal so if you have '.$string.' the out put will be .$string. With double quotes ".$string." the output would be whatever $string = to

quantum-x · 12-17-2009, 12:21 AM

Everyone who has replied to this thread writes code vulnerable to SQL injections - never hire anyone from this thread.

12-16-2009, 12:04 PM	#1
mkx Confirmed User Industry Role: Join Date: Nov 2003 Location: Toronto Posts: 4,001	Quick PHP / Mysql question I am trying to insert the $array[14] result into my mysql database but it is just inserting $array[14] in plain text instead of the variable. Code: <?php include 'dbconnect.php'; $query = "SELECT * FROM messages WHERE id=43"; $result = mysql_query($query); while($row = mysql_fetch_array($result)) { $str = $row['message']; } $arrays = (explode(",\"",$str)); //seperates anything with ," $arrays = (explode("\"",$str)); //reseperates anything with " echo $arrays[14]; //prints result 14 mysql_select_db($mysql); $query = 'INSERT INTO `sms`.`redirects` (`id`, `msg`, `from_num`, `to_num`, `from_country`, `to_country`, `status2`, `time_created`) VALUES (NULL, \'apples\', \'peanuts\', \'$arrays[14]\', \'\', \'\', \'\', \'\');'; mysql_query($query) or die('Error, insert query failed'); $query = "FLUSH PRIVILEGES"; mysql_query($query) or die('Error, insert query failed'); ?> I tried uts\', \'"$arrays[14]"\', \' uts\', \'echo $arrays[14]\', \' uts\', \'".$arrays[14]."', \' and a few other variations but it just gave a http 500 error or inserted it in plain text. Incase your wondering about the weird insert command and all the unnecessary back slashes, I got the code from inserting manually into the mysql database and hitting create php code since nothing else was really working. Last edited by mkx; 12-16-2009 at 12:06 PM..

12-16-2009, 12:09 PM	#2
grumpy Too lazy to set a custom title Join Date: Jan 2002 Location: Holland Posts: 9,870	try this Code: $query = 'INSERT INTO `sms`.`redirects` (`id`, `msg`, `from_num`, `to_num`, `from_country`, `to_country`, `status2`, `time_created`) VALUES (NULL, \'apples\', \'peanuts\', \'".$arrays[14]."\', \'\', \'\', \'\', \'\');'; __________________ Don't let greediness blur your vision \| You gotta let some shit slide icq - 441-456-888

12-16-2009, 12:27 PM	#4
mkx Confirmed User Industry Role: Join Date: Nov 2003 Location: Toronto Posts: 4,001	hmm both suggestions just insert the plain text into the to_num field ".$arrays[14]." and {$arrays[14]} I tried doing it with double quotes before but it kept screwing up so I am just copying it from the create php code option in phpmyadmin. Last edited by mkx; 12-16-2009 at 12:30 PM..

12-16-2009, 01:21 PM	#6
borked Totally Borked Industry Role: Join Date: Feb 2005 Posts: 6,284	single and double quotes.... you're getting all mixed up and confused... run this script and see for yourself where your problem lies.... Code: <?php $array[5] = 'single quote'; $array[6] = 'double quote'; echo 'This is an echo from within a {$array[5]} <br>'; echo "This is an echo from within a {$array[6]} <br>"; ?> __________________ For coding work - hit me up on andy // borkedcoder // com (consider figuring out the email as test #1) All models are wrong, but some are useful. George E.P. Box. p202

12-16-2009, 01:23 PM	#7
Bird Confirmed User Join Date: Jan 2005 Location: Stockton Posts: 4,365	Yes single quotes means literal so if you have '.$string.' the out put will be .$string. With double quotes ".$string." the output would be whatever $string = to __________________ ICQ:268731675

12-16-2009, 12:11 PM	#3
Fuckin Bill Confirmed User Join Date: Feb 2003 Posts: 1,020	You have to enclose an array in curly brackets. \'{$array[14]}\' You should also use double quotes around the query, then you won't have to escape every single quote in the line.

12-17-2009, 12:21 AM	#10
quantum-x Confirmed User Join Date: Feb 2002 Location: ICQ: 251425 Fr/Au/Ca Posts: 6,863	Everyone who has replied to this thread writes code vulnerable to SQL injections - never hire anyone from this thread. __________________ PrettyInCash.com - BoozedGFs.com - TeenGFs.com - JizzGFs.com- MilfUploads.com -