Question

所以我知道这已被弃用且不安全，但这是我在切换到SQLi之前尝试完成的最后一件事。我不认为这是在SQL中应该太复杂。无论如何，我试图循环为每个用户ID输入生成一行到_POST'userids'字段。它是相对简单的多收件人消息系统的一部分

    if (empty($_POST['userids'])) {
        echo "no user ids input";
        }  
    $seq = 1;
    $uids = explode(',', $_POST['userids']);
    $uids[] = $sess_username;  
    $uids = array_unique($uids);

        print_r(array_values($uids));

    $rows = array();
    foreach ($uids as $uid) {
                $rows[] = array('uid'=>(int)$uid);
    }

        print_r(array_values($rows));

        if (!$uids) {
            die('No user ids selected: ' . mysql_error());


    if (empty($messageid)) {
        $messageid = mysql_insert_id();
        }
   $insertSql = "INSERT INTO message_recips (messageid, sequence, userid, status) VALUES";

    foreach ($rows as $row) {

        $insertSql .= "(" . $params[] = $messageid . "," . $params[] = $seq . "," . $params[] = $row['uid'] . ",'" . $params[] = $row['uid'] == $sess_user_id ? 'A' : 'N' . "'),";
    }

    $insertSql = substr($insertSql, 0, -1);

    var_dump($insertSql);
    var_dump($params);

    $result1 = mysql_query($insertSql);

    echo "$insertSql";


    var_dump($insertSql);
    var_dump($params);
    if (!stmt) {
        "sql error after stmt";
    }

    die(header('Location: view.php?id=' . $mid));
} else {

    echo "no recips found";
    die('no recips found');
}

我的数组填充了：

array (size=8)
0 => int 35
1 => int 1
2 => int 273
3 => string 'N' (length=1)
5 => int 1
6 => int 0
7 => string 'N' (length=1)

我的sql结果是：

string 'INSERT INTO message_recips VALUES('35', '1', 'Array', 'Array')' (length=62)

数组看起来不错，但它只在我的SQL表中生成一行并将前四个值插入该行。

衷心感谢任何帮助。-a

Answer 1

看看这是否能让您更接近您的需求。我已经评论了变化的地方。

error_reporting(E_ALL);
if(empty($_POST['userids'])) {
        echo "no user ids input";
    }
else {
        $seq    =   1;
        $uids   =   explode(',', $_POST['userids']);
        $uids[] =   $sess_username;  
        $uids   =   array_unique($uids);

        foreach($uids as $uid) {
                $rows[] = array('uid'=> (int)$uid);
            }

        // You have a syntax error here         
        if (!$uids)
            die('No user ids selected: ' . mysql_error());

        if(empty($messageid))
            $messageid = mysql_insert_id();

        // Set a multi-dimensional array
        $i  =   0;
        foreach($rows as $row) {
                $params[$i][]   =   "'$messageid'";
                $params[$i][]   =   "'$seq'";
                $params[$i][]   =   "'".$row['uid']."'";
                $params[$i][]   =   ($row['uid'] == $sess_user_id)? "'A'" : "'N'";
                $i++;
            }

        // Set front of sql statement, I am just placeholding column names, you need to change them
        $insertSql   = "INSERT INTO message_recips (`message_id`,`seq`,`uid`,`session`) VALUES";

        // Implode the values generated above
        foreach($params as $arrays) {
                $values[]   =   "(".implode(",",$arrays).")";
            }

        // Implode the multiple rows
        $sqls   =   implode(",",$values);
        // Combine front with end
        $sql    =   $insertSql.$sqls;

        $result = mysql_query($sql);
    }

循环通过sql insert语句生成多行

1 个答案: