will this work

[gotornot]

I am trying to insert all extra questions asked on data cpture into a db will this work

 

if (isset($_REQUEST))

{

foreach($_REQUEST as $key=>$value)

{

// only get the data for extra questions

$schq = "SELECT * FROM extraq WHERE programid='$programid'";

$schr = mysql_query($schq);

while($schrow=mysql_fetch_array($schr))

{

$thisqid = $schrow["id"];

if ($thisqid=='$key')

{

$addq3 = "INSERT INTO $extraqopt (extraqid, value, subid) VALUES ('$thisqid', '$value', '$subid')";

$addr3 = mysql_query($addq3);

}

}

}

}

[ignace]

if (!empty($_REQUEST)) {
    $sql = "SELECT * FROM extraq WHERE programid = $programid";
    $result = mysql_query($sql);
    if (0 !== ($row_count = mysql_num_rows($result))) {
        // LOL, I just thought about this
        $rows = array_map('mysql_fetch_assoc', array_fill(0, $row_count, $result));
        $keys = array_keys($_REQUEST);
        foreach ($rows as $row) {
            if (in_array($row['id'], $keys)) {
                $id = intval($row['id']);
                $value = $_REQUEST[$row['id']];
                $sql = "INSERT INTO $extraqopt (extraqid, value, subid) VALUES ($id, '$value', $subid)";
                if (!mysql_query($sql)) {
                    trigger_error("Query failed: $sql", E_USER_WARNING);
                    continue; // does the code after trigger_error() execute? The manual doesn't explicitly say it doesn't?
                }
            }
        }
    }
}

 

[Psycho]

Here's my input:

 

It *may* work. Im not going to really review the code as using foreach() and while() loops to run multiple queries is just a bad idea. Running multiple queries like that will have a huge overhead on your server and can cause pages to timeout when loading. Why would you need to run the query against the "extraq" table for each $_REQUEST value when the value is not used in the query and you are not updating the data in that table within the loops? The data will be the same on each query, right? Not to mention you are using "*" to get allfields from the query, but only using one field.

 

Plus, you are running this query on user input that is not validated! This is a perfect situation where someone could create havoc in your database using sql injection.

 

if (isset($_REQUEST))
{
    //Get records from extraq table and put into array
    //Query only needs to be run once
    $query  = "SELECT `id` FROM `extraq` WHERE `programid`='$programid'";
    $result = mysql_query($schq);
    $extraq_IDs = array();
    while($row=mysql_fetch_assoc($result))
    {
        $extraq_IDs[] = $row['id']
    }

    //Get keys for the request values
    $requestKeys = array_keys($_REQUEST);

    //Compute the values to be inserted
    $insertIDs = array_intersect($requestKeys, $extraq_IDs);

    //Create insert query
    $valuesAry = array;
    foreach($insertIDs as $id)
    {
        $valuesAry[] = "('$id', '" . mysql_real_escape_string($_REQUEST[$id]) . "', '$subid')";
    }
    $query = "INSERT INTO $extraqopt (extraqid, value, subid) VALUES " . implode(', ', $valuesAry);
    $result = mysql_query($query);
}