我怎么能在PHP表单中添加一个字段

Question

I'm looking for a sql statement where I can add additoinal text to a form field when being submitted to a mysql database. For example: A field contains a file name that has been loaded to a Web server called "mydoc.pdf". I want to prepend the following text "http://www.example.com/uploads/", so when the form is submitted the field data becomes "http://www.example.com/uploads/mydoc.pdf".

Right now the unappended field "tofiles_link" uses the following mysql query statement to insert to the mysql database:

mysql_query("INSERT INTO site_tofiles (tofiles_title, tofiles_body, 
tofiles_link, tofiles_relation, tofiles_type,  tofiles_post_ip, 
tofiles_post_user) VALUES 
('".mysql_real_escape_string($_POST['tofiles_title'])."', 
'".mysql_real_escape_string($_POST['tofiles_body'])."', 
'".mysql_real_escape_string($_POST['tofiles_link'])."', 
'".mysql_real_escape_string($_POST['tofiles_relation'])."', 
'".mysql_real_escape_string($_POST['tofiles_type'])."',  
'".mysql_real_escape_string($_SERVER['REMOTE_ADDR'])."', 
'".mysql_real_escape_string($_GET['tofiles_post_user'])."')");

echo "Data was Entered Successfully!
";
mysql_close($conn);

Can this be modified to suit my puroses? THX

Answer 1

To make the code more readable I would do your escaping before creating the SQL query. Not required but makes the code easier to read.

$title = mysql_real_escape_string($_POST['tofiles_title']);
$body = mysql_real_escape_string($_POST['tofiles_body']);
$link = "http://www.example.com/uploads/" . mysql_real_escape_string($_POST['tofiles_link']);
$relation = mysql_real_escape_string($_POST['tofiles_relation']);
$type = mysql_real_escape_string($_POST['tofiles_type']);
$ip = $_SERVER['REMOTE_ADDR'];
$post_user = mysql_real_escape_string($_GET['tofiles_post_user']);

Notice the $link variable on the 3rd line above adds the URL to the string.

$sql = "INSERT INTO site_tofiles (tofiles_title, tofiles_body, tofiles_link, tofiles_relation, tofiles_type,  tofiles_post_ip, tofiles_post_user) VALUES ";
$sql .= "('$title', '$body', '$link', '$relation', '$type', '$ip', '$post_user');";
mysql_query($sql);

echo "Data was Entered Successfully!
";
mysql_close($conn);