PHP - Inserting Specific Mysql Records Into A Php Post Form

 // an array items to insert
    $array = array( 'theid'   => $theid,
            'descr'      =>   $descr,
            'costperunit'    => $costperunit,
            'quantity'       => $quantity,
'costperlot'       => $costperlot
            );


    // begin the sql statement
    $sql1 = "INSERT INTO  descriptions (jobid, description, costperunit, quantity, costperlot) VALUES ";

    $it = new ArrayIterator( $array );


    // a new caching iterator gives us access to hasNext()
    $cit = new CachingIterator( $it );


    // loop over the array
    foreach ( $cit as $value )
    {
        // add to query
        $sql1 .= "('".$cit->key()."','" .$cit->current()."')";
       

        if( $cit->hasNext() )
        {
            $sql1 .= ",";
        }
    }

In brief, I'm attempting to capture the form data from a dynamic form to a mysql database.

From he

To He

The post data looks like this from the form -
DATA SUBMITTED:

Array(

...
[petlist] => [{"Pet Name":"Hal","Pet Type":"Dog","Breed":"Lab","DOB":"02/10/2013","Gender":"Male","Special Needs":"No"},
{"Pet Name":"Bill","Pet Type":"Dog","Breed":"Golden","DOB":"03/20/2015","Gender":"Male","Special Needs":"No"}]
...

)

PHP CODE:

...
$_POST['petlist'];
...

As a non-php or mysql developer, I'm learning on the fly.  This is a section of the php file that I was using to post the form data to mySQL.  This worked great up to the point I added the dynamic form widget.

<?php
// This function will run within each post array including multi-dimensional arrays
function ExtendedAddslash(&$params)
{
        foreach ($params as &$var) {
            // check if $var is an array. If yes, it will start another ExtendedAddslash() function to loop to each key inside.
            is_array($var) ? ExtendedAddslash($var) : $var=addslashes($var);
            unset($var);
        }
}

// Initialize ExtendedAddslash() function for every $_POST variable
ExtendedAddslash($_POST);     

$submission_id = $_POST['submission_id'];
$formID =$_POST['formID'];
$ip =$_POST['ip'];
$fname =$_POST['fname'];
$lname =$_POST['lname'];
$spousename =$_POST['spousename'];
$address =$_POST['address'][0]." ".$_POST['address'][1]." ".$_POST['address'][2]." ".$_POST['address'][3]." ".$_POST['address'][4]." ".$_POST['address'][5];
... 

$db_host = 'localhost';
$db_username = 'xxxxx';
$db_password = 'xxxxx';
$db_name = 'xxxxx';

mysql_connect( $db_host, $db_username, $db_password) or die(mysql_error());
mysql_select_db($db_name);

// search submission ID

$query = "SELECT * FROM `tableName` WHERE `submission_id` = '$submission_id'";
$sqlsearch = mysql_query($query);
$resultcount = mysql_numrows($sqlsearch);

if ($resultcount > 0) {
 
    mysql_query("UPDATE `tableName` SET
                                `fname` = '$fname',
                                `lname` = '$lname',
                                `spousename` = '$spousename',
                                `address` = '$address',
                                 
                                 WHERE `submission_id` = '$submission_id'")
     or die(mysql_error());
   
} else {

    mysql_query("INSERT INTO `tableName` (submission_id, formID, IP, fname, lname, spousename, address)
                               VALUES ('$submission_id', '$formID', '$ip', '$fname', '$lname', '$spousename', '$address') ")
    or die(mysql_error()); 

}
?>

It has been suggested that I explore using the PHP Explode() function.  It's possible that may work, but can't get my head around how to apply the function to the PETLIST Array.

Looking for suggestions or direction to find a solution for this challenge.  Looking forward to any replies.

	public function getColumnNames($table){
		$sql = "SELECT COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name = :table";
		try {
			$stmt = $this->dbh->prepare($sql);
			$stmt->bindValue(':table', $table, PDO::PARAM_STR);
			$stmt->execute();
			$output = array();
				while($row = $stmt->fetch(PDO::FETCH_ASSOC)){
				$output[] = $row['COLUMN_NAME'];                
			}
			
			$all = array($output);
			
			$a1 = array_slice($output, 1); // I don't want column 1, it contains the ID, its auto incremented.
			$a2 = array_slice($a1, 0, -3); // I don't want the last 3 columns as they have default values
			
			$selected = array($a2);  // contains all the columns except those excluded by array_slice, columns now match all of the input fields on the form
			
			foreach ($selected as $row){
					$fields = "`" . implode('`, `', $row) . "`"; // I'm making `fields` here,
					$bind = ":" . implode(', :', $row);	// And making :values here			
					}	
			return array (
					"raw" 	        => $all,
					"fields" 	=> $fields,
					"bind"		=> $bind
				     );
			}
			catch(PDOException $pe) {
			    trigger_error('Could not connect to MySQL database. ' . $pe->getMessage() , E_USER_ERROR);
			}
	}
	
	public function addRecord(){
		$col = array();
		$col = $this->getColumnNames("table");
		$raw = array($col['raw']);
		$fields = array($col['fields']);
		$bind = array($col['bind']);
		$columnList = implode('`, `', $fields);
		$paramList = implode(', ', $bind); 
		
		$sql = "INSERT INTO `{$this->dbtable}` ($columnList) VALUES ($paramList)";
		
		return $sql; // this returns something like:
INSERT INTO `table` (`field1`, `field2`, `field3`) VALUES (:field1, :field2, :field3)";

I'm trying to create a script to use PDO prepared statements to enter data from a post form using functions to perform the PDO required statements.  But, it's not working.  When I execute it, it enters null in all the fields.

I'm hoping someone can tell me why this is not working.

I think the functions output what PDO is looking for.

I'm not sure how to do this otherwise without writing a lot of code like

$site_name= $_POST['site_name'];

and entering all of that in the PDO statments.  It seemed like it made sense to create the statements from the post array.

My code is included below and after that is some output I used to monitor what is going on that shows the output of the functions in the script.

Am I doing this all wrong.  Is another approach that I haven't discovered?

Thanks

--Kenoli

<?php

if(isset($_POST['submit'])){
    
    /** Establish DB connection.  Not real data, of course. */    
        
    $conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password);
      // set the PDO error mode to exception
      $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

    /** Remove empty $_POST elements. */
    
    $insert_array = array_filter($_POST);
        
    /** Whitelists input to identify columns to which changes are allowed */
 
    $whitelist = array('site_name' =>'', 'site_address' =>'', 'description' =>'', 'surface' =>'', 'tio_contact' =>'', 'site_contact' =>'', 'contact_phone' =>'', 'contact_email' =>'', 'contact_date' =>'', 'comments' =>'');
 
    $insert_array = array_intersect_key($insert_array,$whitelist);
    
    /************/
    
    /** Create query from $insert_array. */
  
  foreach($insert_array as $key => $value) {  
        $col .= $key . ', ';  
        $val .= ':' .$key . ', ';
    }
    
    /** Remove ', " from end of each array. */
    /* For use with update actions to prevent deleting data from fields that contain data. */
    
    $col = substr_replace($col ,"",-2);
    $val = substr_replace($val ,"",-2);
    
    $sql = "INSERT INTO Sites ($col) VALUES ($val)";
    
    /* The result is:  INSERT INTO Sites (site_name, site_address, description, contact_phone) VALUES (:site_name, :site_address, :description, :contact_phone)*/
    
    /************/
    
    /** Prepared statement functions */
    
    $stmt = $conn->prepare($sql);
    
    foreach($insert_array as $key => $value) {
        $param = ':' . $key;
        $stmt->bindParam($param, $$value);
        echo '$' . "stmt->bindParam($param, $$key)<br>"; // Monitor output
    }
    
    foreach($insert_array as $key => $value) {
        $$key = $value;
        echo "$$key = $value<br>";     // Monitor output
    }
    
    $stmt->execute();  // Execute insert


?>

The result with dummy data:

$insert_array

(
    [site_name] => asdfasdf
    [site_address] => Asdffads
    [description] => Asdfs
    [contact_phone] => Asdfsdaf
)
Here is the prepared statement:
INSERT INTO Sites (site_name, site_address, description, contact_phone) VALUES (:site_name, :site_address, :description, :contact_phone)

$stmt->bindParam(:site_name, $site_name)
$stmt->bindParam(:site_address, $site_address)
$stmt->bindParam(:description, $description)
$stmt->bindParam(:contact_phone, $contact_phone)

$site_name = asdfasdf
$site_address = Asdffads
$description = Asdfs
$contact_phone = Asdfsdaf

Everything looks right but  NULLs are inserted in all fields.