Help with Textbox Arrays

[jedeye]

I am currently writing a script, well, attempting to write a script where the user is able to add an unlimited amount of text boxes via javascript:

 

var i = 1;

function AddTxtBox() {

new_textbox.innerHTML = new_textbox.innerHTML +"<br />Misc Item " + i + ": <input type='text' name='prod_misc[]' placeholder='Misc Product Info' />"
i++;
}

 

 

The js code works fine adding the text boxes. My first question is: in the "name" field; the name I have is "prod_misc[]" is that correct for adding the input into an array?

 

Second question:

 

I want to input that data from the "prod_misc[]" array into SQL, namely PostgreSQL. Should I use a "for()" loop to extract each key of data from the array "prod_misc[]"? If so, what syntax do I use to input an array of data like that into SQL?

 

 

Thanks so much in advance for this help... I am in great need and it's very appreciative.

[requinix]

1. Yes.

2. A foreach would be better.

foreach ((array)$_POST["prod_misc"] as $prod_misc) {
    // do whatever
}

[jedeye]

thanks for the response.. I ended up using a foreach() prior to your response to test the theory i had and it worked

foreach( $prodMisc as $key => $value ) { 
echo "KEY: " .  $key . "<br />  VALUE: " . $value . "<br />";
}

 

now i'm pretty sure i need to place my sql statement inside that loop to iterate through the keys and place each value from the input on a new row in the database

INSERT INTO table_name(field1, field2) VALUES('$var1','$value')

 

where $value equals the actual input from the text box named "prod_misc" ... correct?

[requinix]

Except for the SQL injection, yes.

 

Use mysql_real_escape_string.

[jedeye]

I'm working with Postgres... and using "pg_escape_string()" instead

 

I put together a function for that.. it's not bulletproof, but there is no such thing anymore. It 'sanitizes' for the most part though

function form($data) {

   $data = preg_replace("[\'\-;|`,<>]", "", $data); 
   $data = pg_escape_string($data); 
   return stripslashes(trim($data));
   
}

 

I'm not completely 'new' to PHP. I just have not had much practice working with arrays...

 

Thanks again bro for your replies

 

 

Edit: edited to say thanks one last time

[requinix]

Ah, right. I said mysql_real_escape_string but something was bugging me about that... Forgot about the "namely PostgreSQL" bit

 

Yes: pg_escape_string.