使用PHP和JavaScript分离SQL插入的变量

Question

A grid table is displayed via PHP/MySQL that has a column for a checkbox that the user will check. The name is "checkMr[]", shown here:

 echo "<tr><td>
 <input type=\"checkbox\" id=\"{$Row[CONTAINER_NUMBER]}\" 
 data-info=\"{$Row[BOL_NUMBER]}\" data-to=\"{$Row[TO_NUMBER]}\" 
 name=\"checkMr[]\" />
 </td>";

As you will notice, there is are attributes for id, data-info, and data-to that are sent to a modal window. Here is the JavaScript that sends the attributes to the modal window:

 <script type="text/javascript">
   $(function()
   {
     $('a').click(function()
     {
       var selectedID = [];
       var selectedBL = [];
       var selectedTO = [];
       $(':checkbox[name="checkMr[]"]:checked').each(function()
       {
         selectedID.push($(this).attr('id'))
         selectedBL.push($(this).attr('data-info'))
         selectedTO.push($(this).attr('data-to'))
       });
       $(".modal-body .containerNumber").val( selectedID );
       $(".modal-body .bolNumber").val( selectedBL );
       $(".modal-body .toNumber").val( selectedTO );
     });
   });
 </script>

So far so good. The modal retrieves the attributes via javascript. I can choose to display them or not. Here is how the modal retrieves the attributes:

 <div id="myModal">
   <div class="modal-body">
   <form action="" method="POST" name="modalForm">
     <input type="hidden" name="containerNumber" class="containerNumber" id="containerNumber" />
     <input type="hidden" name="bolNumber" class="bolNumber" id="bolNumber" />
     <input type="hidden" name="toNumber" class="toNumber" id="toNumber" />
   </form>
   </div>
 </div>

There are additional fields within the form that the user will enter data, I just chose not to display the code. But so far, everything works. There is a submit button that then sends the form data to PHP variables. There is a mysql INSERT statement that then updates the necessary table.

Here is the PHP code (within the modal window):

 <?php
 $bol = $_POST['bolNumber'];    
 $container = $_POST['containerNumber']; 
 $to = $_POST['toNumber'];  

 if(isset($_POST['submit'])){
 $bol = mysql_real_escape_string(stripslashes($bol));
 $container = mysql_real_escape_string(stripslashes($container));
 $to = mysql_real_escape_string(stripslashes($to));

 $sql_query_string = 
   "INSERT INTO myTable (bol, container_num, to_num)
   VALUES ('$bol', '$container', '$to')
 }
    if(mysql_query($sql_query_string)){
      echo ("<script language='javascript'>
             window.alert('Saved')
             </script>");
    }
    else{
      echo ("<script language='javascript'>
             window.alert('Not Saved')
             </script>");
   }
 ?>

All of this works. The user checks a checkbox, the modal window opens, the user fills out additional form fields, hits save, and as long as there are no issues, the appropriate window will pop and say "Saved."

Here is the issue: when the user checks MULTIPLE checkboxes, the modal does indeed retrieve multiple container numbers and I can display it. They seem to be already separated by a comma.

The problem comes when the PHP variables are holding multiple container numbers (or bol numbers). The container numbers need to be separated, and I guess there has to be a way the PHP can automatically create multiple INSERT statements for each container number.

I know the variables need to be placed in an array somehow. And then there has to be a FOR loop that will read each container and separate them if there is a comma.

I just don't know how to do this.

Answer 1

When you send array values over HTTP as with [], they will already be arrays in PHP, so you can already iterate over them:

foreach ($_POST['bol'] as $bol) {
    "INSERT INTO bol VALUES ('$bol')";
}

---

Your queries are vulnerable to injection. You should be using properly parameterized queries with PDO/mysqli