Php - variable in variable name

Question

I have a form with several checkboxes. These boxes have one row each in a mysql db if checked. Now, I need to have a loop that build a query to delete all rows that is not checked. I tried the one below but the array is never populated... Any help is appreciated...

$chk_cab_1  = isset($_POST['chk_cab_1']) ?: 0;
$chk_cab_2  = isset($_POST['chk_cab_2']) ?: 0;
$chk_cab_3  = isset($_POST['chk_cab_3']) ?: 0;
$chk_cab_4  = isset($_POST['chk_cab_4']) ?: 0;
$chk_cab_5  = isset($_POST['chk_cab_5']) ?: 0;
$chk_cab_6  = isset($_POST['chk_cab_6']) ?: 0;
$chk_cab_7  = isset($_POST['chk_cab_7']) ?: 0;
$chk_cab_8  = isset($_POST['chk_cab_8']) ?: 0;
$chk_cab_9  = isset($_POST['chk_cab_9']) ?: 0;
$chk_cab_10 = isset($_POST['chk_cab_10']) ?: 0;
$chk_cab_11 = isset($_POST['chk_cab_11']) ?: 0;


$check_cab    = array();
$del_cab_ids  = array();
for($i = 1; $i<=$counter; $i++) {
    $check_cab["chk_cab_$i"]     = $chk_cab_$i;
    if($check_cab["chk_cab_$i"] == 0) {
       $del_cab_ids[] = $i;
    }
}

$sql = "DELETE FROM mytable 
        WHERE first_id = $t_key
        AND second_id IN ($del_cab_ids)";

You can use <input name="chk_cab[5]" type="checkbox" value="1" /> so that you get an array immediately. — Ja͢ck
– Ja͢ck, Commented Mar 6, 2014 at 8:47

Ja͢ck · Accepted Answer · 2014-03-06 09:07:12Z

2

I would change the HTML, if possible to rename the checkboxes like this:

<input name="chk_cab[0]" type="checkbox" value="1" />
...
<input name="chk_cab[5]" type="checkbox" value="1" />
...

And then invert the query:

$sql = "DELETE FROM mytable WHERE first_id = ?";

if (isset($_POST['chk_cab']) {
    $ids = join(',', array_map('intval', array_keys($_POST['chk_cab'])));

    $sql .= " AND second_id NOT IN ($ids)";
}

Important: This assumes that all entries matched by first_id = <whatever> are accounted for within [1 .. $counter].

edited Mar 6, 2014 at 9:07

answered Mar 6, 2014 at 8:56

Ja͢ck

174k39 gold badges269 silver badges317 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

user2864740 Over a year ago

Wrt "inverting the query"; it's not strictly semantically equivalent and could delete data erroneously here -- A case might be made that this would be a better solution overall, but I would rather keep the approach the same as in the original to avoid issues (e.g. "phantom deletes") with concurrency.

Ja͢ck Over a year ago

@user2864740 While that is technically possible; the query is limited by the first part of the query; in any case, I've updated the answer to make OP stop and think first.

user2864740 · Accepted Answer · 2014-03-06 08:51:37Z

1

Create an array at the start. This avoids nonsense with "variable variables"¹

$del_cab_ids = array();
for($i = 1; $i<=$counter; $i++) {
   # it's easier/cleaner to use a dynamic key than a dynamic variable
   $v = isset($_POST['chk_cab_' . $i]) ?: 0;
   if ($v == 0) {
     $del_cab_ids[] = $i;
   }
}

Also, at least use mysqli_real_escape_string .. but I recommend using placeholders and binding the values ..

¹ While I don't agree with "variable variables", the usage is as such:

$varname = "chk_cab_" . $i;
$value = $$varname;

# or
$value = ${"chk_cab_" . $i}

edited Mar 6, 2014 at 8:51

answered Mar 6, 2014 at 8:44

user2864740

62.5k15 gold badges159 silver badges234 bronze badges

Comments

Zeeshan · Accepted Answer · 2014-03-06 08:52:38Z

1

Try this....

$check_cab["chk_cab_$i"] = ${'chk_cab_'.$i}

edited Mar 6, 2014 at 8:52

Zeeshan

1,68314 silver badges18 bronze badges

answered Mar 6, 2014 at 8:50

user3383116

3921 silver badge7 bronze badges

Comments

Marcel · Accepted Answer · 2014-03-06 09:18:26Z

1

The complete structure seems to be a bit ... ugly. Sorry for that. ;) So you can avoid that mass of unnecessary variables by using a simple array for your post data.

<input type="checkbox" value="1" name="my-checkbox[]" id="my-checkbox-1" /> 1
<input type="checkbox" value="2" name="my-checkbox[]" id="my-checkbox-2" /> 2

With this you can grab all the IDs in one simple line of PHP code as follows:

if (isset($_POST['my-checkbox'])) $myIDs = array_map('intval', $_POST['my-checkbox']);

So all your post IDs have been validated as an integer value so you can proceed with your database statement. For this I recommend using statements like the PDO object gives you with PDO Statements to avoid security issues. Have a look at the following example:

try {
    $pdo = new PDO(...);
    $sql = "DELETE FROM mytable WHERE first_id = :first_id AND FIND_IN_SET(CAST(second_id AS char), :second_id)";

    $statement = $pdo->prepare($sql);
    $statement->execute(array(
        ':first_id' => $first_id,
        ':second_id' => implode(",", $myIDs)
    ));
} catch(PDOException $e) {
    // error handling
}

That 's all. With this small example all your structure and security problems should have been solved.

edited Mar 6, 2014 at 9:18

answered Mar 6, 2014 at 8:53

Marcel

5,1811 gold badge18 silver badges27 bronze badges

5 Comments

Marcel Over a year ago

I 'm always open for advice. Where 's the sql injection problem in your eyes?

user2864740 Over a year ago

Whoops, that was wrong (binding prevents the SQL injection) .. but does this even work? I would expect passing in a CSV string as as placeholder value would not.

Marcel Over a year ago

Yes, this even works. You 've validated the post data before with intval() and after that pdo does even an extra escaping with in the statement. This works fine. ;)

user2864740 Over a year ago

I mean, why/how is does this placeholder (:second) result in .. IN ('1','2','3') and not .. IN ('1,2,3')?

Marcel Over a year ago

Just tested it on my localhost, cos I was not quite sure. But it works perfectly. The placeholder is not replaced as a string. Just fine, comma seperated integer values. ;)

Ramesh · Accepted Answer · 2014-03-06 08:37:07Z

0

Try:

$del_cab_ids = implode(',', $del_cab_ids);
$sql = "DELETE FROM mytable 
    WHERE first_id = $t_key
    AND second_id IN ($del_cab_ids)";

answered Mar 6, 2014 at 8:37

Ramesh

4,3032 gold badges20 silver badges24 bronze badges

4 Comments

Madara's Ghost Over a year ago

Your code doesn't even mention the horrible SQL injection vulnerability this solution has.

Ramesh Over a year ago

Second Ricudo, I was pointing why his query was having problems executing.

Realitätsverlust Over a year ago

When i give examples for SQLs, i neither write it perfectly save. The examples are only for giving a hint into the right direction, not just copy and paste.

Vercingetorix Over a year ago

I am aware of the SQL injection issue. I wrote the sql to show in a simple way how I will use the array.

Collectives™ on Stack Overflow

Php - variable in variable name

5 Answers 5

2 Comments

Comments

Comments

5 Comments

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

2 Comments

Comments

Comments

5 Comments

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related