|
|
Posted by Michael Fesser on 08/21/07 21:59
..oO(Ron Eggler)
>I want to do a mysql query and need an int for this but i get the value as
>string, so i tried this:
> if ($_POST['seminar']!="") //seminar defined?
> {
Better:
if (!empty($_POST['seminar'])) {
Your code will throw a notice in case $_POST['seminar'] is not
available. Unlikely, but possible.
> $seminar=$_POST['seminar']; //get seminar from post
> $attending=$_POST['attending']; // get attending from post
> // convert string to int
> if ($attending=="1")
> $INTatt==1;
> [...]
For converting an int to a string there's intval().
But the above won't work at all - it's no assignment, but a comparison.
> if (is_int($INTatt))
> echo "int";
> $query="UPDATE seminar SET taken = taken+".$INTatt." where `time-date`
>= '".$seminar."'";
No need for concatenation here, you can embed the variables directly
into the string (that's what the double-quotes are for!):
$query = "
UPDATE seminar
SET taken = taken+$INTatt
WHERE `time-date` = '$seminar'";
> mysql_query($query);
> }
>It doesn't print "int" as it should when going thru is_int(). Why is this
>variable $INTatt no int?
You should set your error_reporting to E_ALL in your php.ini - you will
get some notices about undefined variables. The '==' operator performs a
comparison, not an assignment. The $INTatt variable is never set to any
value at all. In short:
== != =
SCNR
>I don't get it... is there another possibility of
>realizing this? the field taken is an int in the db (apparently).
Just check that $_POST['attending'] exists and is numeric, then do
whatever you want with it:
if (isset($_POST['attending']) && is_numeric($_POST['attending'])) {
...
} else {
// error
}
Or explicitly cast to a string with intval() if you want to accept even
invalid values (might result in the value '0').
Then, if the value of $attending has to be in a particular range, just
do that with a simple if-statement:
if ($attending >= 1 && $attending <= 3) {
...
} else {
// error
}
You also have to perform some checking on the seminar variable!
Currently it's used directly as posted in the query - an invitation for
SQL injection (google that). Consider to use PDO and prepared statements
to be safe when doing database operations with user-submitted values.
HTH
Micha
Navigation:
[Reply to this message]
|