Dynamic request -> mysql_query function

[lt]

Hi y'all!

 

I'm working on a form-system in PHP that connects to a MySQL database. I have a lot of these:

 

$id = ''; 
$time = '';
$heading = '';
$for = '';
$description = '';
//and more...

if (isset($_REQUEST['id'])) {$id = $_REQUEST['id'];}
if (isset($_REQUEST['time'])) {$time = $_REQUEST['time'];}
if (isset($_REQUEST['heading'])) {$heading = $_REQUEST['heading'];}
if (isset($_REQUEST['for'])) {$for = $_REQUEST['for'];}
if (isset($_REQUEST['description'])) {$description = $_REQUEST['description'];}

mysql_query ("
UPDATE posts SET
time = '$time',
heading = '$heading',
for = '$for',
description = '$description'
WHERE id = $id
LIMIT 1
;");

 

I'm thinking if it is possible to make a dynamic function to handle this? Kind of...:

 

req("id", array("time", "heading", "for", "description"));

function req($id, $reqThings){
foreach($reqThings as $reqThing){
	//something....
}
}

 

The "id" is special because it is used in the "WHERE id = $id"-part of the mysql_query

 

I really hope you can help! Just ask if I have to be more precise... ;-)

[ignace]

function update($table, $data, $where) {
    mysql_query('UPDATE ' . $table . ' SET ' . _create_set_clause($data) . ' WHERE  ' . _create_where_clause($where));
}

 

$data and $where are both array's in the format: $column => $value

[AbraCadaver]

You can abstract it more or less, this is kind of in between (not tested):

 

function update($table, $id, $reqThings) {
    if(empty($table) || empty($id) || !is_array($reqThings)) { return false; }

    foreach($reqThings as $thing) {
        $value = !empty($_REQUEST[$thing]) ? mysql_real_escape_string($_REQUEST[$thing]) : '';
        $set[] = "`$thing` = '$value'"
    }   
    $set = implode(',', $set);

    return mysql_query("UPDATE `$table` SET $set WHERE id = '$id' LIMIT 1");
}

[ignace]

You can abstract it more or less, this is kind of in between (not tested):

 

function update($table, $id, $reqThings) {
    if(empty($table) || empty($id) || !is_array($reqThings)) { return false; }

    foreach($reqThings as $thing) {
        $value = !empty($_REQUEST[$thing]) ? mysql_real_escape_string($_REQUEST[$thing]) : '';
        $set[] = "`$thing` = '$value'"
    }   
    $set = implode(',', $set);

    return mysql_query("UPDATE `$table` SET $set WHERE id = '$id' LIMIT 1");
}

 

Assuming the PK to be named id is a false-positive, mine actually have the table name prefixed. An anti-pattern some frameworks have picked up. LIMIT 1 is also obsolete, ID is a PK and therefor unique. Also, not every table has a single column as an ID, some are compound.