PHP array implode keys and values to function

Question

I'm not too familiar with PHP arrays, I have the following code that generates query to output the results needed.

$allstore = $_POST['store'];


 function createSelect($allstore)
{
    if (empty($allstore))
        return "";

    $querySelect = "";
    $queryJoin = "";
    $baseTable = "";
    foreach ($allstore as $store => $value) {
        if (!$querySelect) {
            $baseTable = $store;
            $querySelect = "SELECT " . $store . ".item_no, " . $store . ".actual_price, " . $store . ".selling_price, " . $store . ".qty as " . $store;
        } else {
            $querySelect .= ", " . $store . ".qty as " . $store;
            $queryJoin .= "
             INNER JOIN " . $store . " ON " . $baseTable . ".item_no = " . $store . ".item_no";
        }
    }
    $querySelect .= " FROM " . $baseTable;
    $query = $querySelect . $queryJoin;

    return $query;
}

//Stores to be shown
$allstore = ['s_M9' =>0 , 's_M10' =>1];

$query = (createSelect($allstore));
$result = mysql_query($query);
//rest of code...

As you can see above, at the very top there is $allstore = $_POST['store']; Which collects values based from previous form POST method that has checkbox with the name=store[] .

Now According to the function shown, if I create my own keys and values like this

$allstore = ['s_M9' =>0 , 's_M10' =>1];

the output shows exactly what i'm looking for. But the problem goes on how to let $allstore implode those stores s_M9, s_M10 based on what the user has selected on the previous page ( checkbox )? I mean, the user can select either one of the stores or Both stores . How can I implode the checked results between those brackets without inserting them manually?

Thank You

Edit :

<?php
echo "<form action='somewhere.php' method='POST'>";

$query = "SELECT * from stores_list ORDER BY short Asc";
$result = mysql_query($query);
if(mysql_num_rows($result)>0){
    $num = mysql_num_rows($result);
    for($i=0;$i<$num;$i++){
    $row = mysql_fetch_assoc($result);
    echo "<input type=checkbox name=store[] value={$row['short']} style='width:20px; height:20px;'>{$row['short']}";
    }
}

else{
    //No Stores Available
    echo "No Stores Found !";
}


echo "</td><input type='submit' value='Search'/></form>";

Oh boy, this is going to be fun. Let me just point out that you are injecting user input into the *program* part of a MySQL query, which is potentially even worse than injecting them into the "values" part. You really, really should not be doing this. — Niet the Dark Absol, Apr 01 '16 at 20:40

score 2 · Accepted Answer · edited May 23 '17 at 11:50

2

$allstore = [];
if (!empty($_POST['store'])) {
    foreach ($_POST['store'] as $value) {
         $allstore[$value] = 1; // or 0, it doesn't matter because your function adds all the keys
    }
}

$query = (createSelect($allstore));
$result = mysql_query($query);

And of course you have to take care of your createSelect function to avoid SQL Injections, please read here

edited May 23 '17 at 11:50

Community

1
1

answered Apr 01 '16 at 20:40

Seva Kalashnikov

4,262
2
21
36

PHP array implode keys and values to function

1 Answers1