使用PHP向DB添加多个字段

Question

I am currently using the following function:

    if(isset($_REQUEST["function"]) && ($_REQUEST["function"] == "setnm")){
$value = $_REQUEST["value"]; //field to edit

$con=mysqli_connect("localhost", "root", "", "hike_buddy");
//Check Connection

if(mysqli_connect_errno())
{
    echo "failed to connect:".mysqli_connect_error();
}

mysqli_query($con, "INSERT INTO user_com (name) VALUES ('$value')");
mysqli_close($con);

}

How can I alter this code so it will change the value of two fields?

For instance I have a comment and a name column and I want to update them both (different values) with one function.

Answer 1

Never use un-escaped strings specified by the user in your database queries.

So, if you're using mysqli:

$value1 = $con->real_escape_string($_REQUEST['value_1']);
$value2 = $con->real_escape_string($_REQUEST['value_2']);
$query = "INSERT INTO my_table (column_1, column_2) VALUES ('$value1', '$value2')";
$con->query($query);