使用switch case将PHP函数与array作为参数来更新MySQL db

Question

HTML CODE:-

<form action="run.php" method="post">
Ambulance ID:<input type="text" name="amb_id">
Select the any of the point and submit:
<input type="radio" name="tposition" value="1">t1  (1 km away from the signal)
<input type="radio" name="tposition" value="2">t2 (before 500 mtrs point) 
<input type="radio" name="tposition" value="3">a3 (500 Mtr from signal)
<input type="radio" name="tposition" value="4">t3 (before signal, after 500 mtrs)
<input type="submit" value="Submit">
</form>

PHP CODE:-

<?php
$ambid = $_POST['amb_id'];
//lattitude array
$lat=array(13.092593,13.092781,13.093126,13.09344,13.093889,13.094349,13.094882,13.095485,13.096575);

//longitude array
$lon=array(77.586415,77.585009,77.583454,77.58251,77.581598,77.580793,77.580096,77.57946,77.578486);

//connect to the db
$con = mysql_connect('localhost', 'root','');
mysql_select_db('traffic', $con);

//check the radio button
  if (isset($_POST['tposition'])) {
     switch($_POST['tposition']) {
    case 1:
        updateDb($lat[0],$lon[0]);
        break;
    case 2:
        updateDb($lat[1],$lon[1]);
        break;

        }
}

    else { echo "Please select any of the tpositon radio button"; }

function updateDb($lati,$longi)
{
$query = "UPDATE emergency SET e_latitude=$lati,e_longitude=$longi WHERE amb_id=$ambid ";
$res= mysql_query($query) or die("Unable to update the latlong values because : " . mysql_error());

}
mysql_close($con);

?>

While running the above script i am getting an error as "Unable to update the latlong values because : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1" .

But instead of function if use the same lines of code for every case it works. Why is that ? Can you help me thanks in advance.

Answer 1

This error is possible occurring because, you are inserting ' character without using mysql_real_escape_string() around the values you insert into your MySQL query. I would suggest, you encapsulate your values like this

$ambid = mysql_real_escape_string($_POST['amb_id']); 

But, I don't recommed you use mysql_ functions at all, as it is very weak and vurnerable to mysql injections, just like your code. Learn PDO instead.