How do I loop through my array and save it to database (PHP)?

Question

I have a table that I select from my database and want the user to update just 1 of the columns. I echo the rows into the table with a user input box that I have added at the end of each row. I have tried foreach loops and end up with an error "Fatal error: Uncaught Error: Object of class mysqli_result could not be converted to string in..." When I print_r the array of the user inputs, it displays, but I'm struggling to use it within prepared statements.

<?php
 if (isset($_POST['save'])){
  

if(!empty($_POST['newbid'])) {
    $biduserID = $_SESSION['id'];
    $itemID = $_GET['ItemId'];
    $bidprice = ($_POST['newbid']);
$getcurrentround = "SELECT `Round` FROM `RoundCounter` WHERE `ItemID` =".$_GET['ItemId']."";
$currentroundresult= $db->query($getcurrentround);
$currentround = $currentroundresult->fetch_assoc();
$currentround1 = $currentround['Round'];
$biddername = $_SESSION["id"];
$count = $_POST['count'];
$newbid = $_POST['newbid']; // check empty and check if interger
print_r($newbid);
$getusername = "SELECT `Username` FROM `User` WHERE `UserID` = `$biddername`";
$username1= $db->query($getusername);
$getbandname = "SELECT `BandName` FROM `BidTables` WHERE `ItemID` =" .$_GET['ItemId']."";
$bandname= $db->query($getbandname);
$getnumberlots = "SELECT numberlots FROM `Item` WHERE `ItemID` =".$_GET['ItemId']."";
    $numberlots= $db->query($getnumberlots);

$bid = 1;
   
    foreach($_POST as $bid => $value) {


    

    $sql4 = "INSERT INTO BidTables (`BandName`,`BidderID`, `ItemID`, `BidPrice`, `Round`, `Username`) VALUES
    (?,?,?,?,?,?)";
    $stmt = $db->prepare($sql4);
    echo $db->error;
    
        $stmt->bind_param("siiiis", $bandname, $biduserID, $itemID, $bid ,$currentround1, $username1 );
$stmt->execute();
}
}
?>

and here is the submit button with the table data:

<form action="" method="POST">
        <table class="table table-hover">
                <thead class="thead">
                <tr class="header">
                    
                    
                <th>ID</th>
                    <th>Band</th>
            <th>Current Price</th>
               
                </tr>
                <?php 
                $sql = "SELECT * FROM BidTables WHERE ItemID = ".$_GET['ItemId']." ORDER BY `Round` DESC";
                $resultSQL= mysqli_query($db, $sql);
                   
                   if(mysqli_num_rows($resultSQL) > 0){
                   
                    }
                   
                   ?>
                </thead>
                <tbody>
                <!-- PHP CODE TO FETCH DATA FROM ROWS -->
                
                <tr>
               
    <?php
    // LOOP TILL END OF DATA
    while($row = $resultSQL->fetch_assoc()) { 
   ?>
      <tr>
        <td><?=$row['bidtable']?></td> 
        <td><?=$row['BandName']?></td>
        <td><?=$row['BidPrice']?></td>
        <td><input type="number" name="newbid[]" size="10" /></td> 
      </tr>
    <?php } ?>
 </table>
 <input type="hidden" name="count" value="<?=$resultSQL->num_rows?>" /> 
 <button class="btn btn-primary btn-lg" name="save">Submit</button>
</form>

I appreciate any help/pointers

EDIT 1: I have used prepared statements for each SELECT, and I am getting the error for each statement in my INSERT function: "Warning: Array to string conversion in..."

This is the code for the prepared statements:

<?php

 if (isset($_POST['save'])){
  

if(!empty($_POST['newbid'])) {
    $biduserID = $_SESSION['id'];
    $itemID = $_GET['ItemId'];
    $bidprice = ($_POST['newbid']);
    
$count = $_POST['count'];
$newbid = $_POST['newbid']; // check empty and check if interger
print_r($newbid);


$sql6 = "SELECT `Round` FROM `RoundCounter` WHERE `ItemID` =?"; // SQL with parameters
$stmt6 = $db->prepare($sql6); 
$stmt6->bind_param("i", $itemID);
$stmt6->execute();
$result6 = $stmt6->get_result(); // get the mysqli result
$round = $result6->fetch_assoc(); // fetch data   



$sql7 = "SELECT `Username` FROM `User` WHERE `UserID` = ?"; // SQL with parameters
$stmt7 = $db->prepare($sql7); 
$stmt7->bind_param("i", $biduserID);
$stmt7->execute();
$result7 = $stmt7->get_result(); // get the mysqli result
$username = $result7->fetch_assoc(); // fetch data   



$sql8 = "SELECT `BandName` FROM `BidTables` WHERE `ItemID` =?"; // SQL with parameters
$stmt8 = $db->prepare($sql8); 
$stmt8->bind_param("i", $itemID);
$stmt8->execute();
$result8 = $stmt8->get_result(); // get the mysqli result
$bandname = $result8->fetch_assoc(); // fetch data   




    $sql9 = "SELECT numberlots FROM `Item` WHERE `ItemID` =?"; // SQL with parameters
$stmt9 = $db->prepare($sql9); 
$stmt9->bind_param("i", $itemID);
$stmt9->execute();
$result9 = $stmt9->get_result(); // get the mysqli result
$numberlots = $result9->fetch_assoc(); // fetch data 

   
    foreach($_POST as $bid => $value) {
      
    $sql4 = "INSERT INTO BidTables (`BandName`,`BidderID`, `ItemID`, `BidPrice`, `Round`, `Username`) VALUES
    (?,?,?,?,?,?)";
    $stmt = $db->prepare($sql4);
    echo $db->error;
    
        $stmt->bind_param("siiiis", $bandname, $biduserID, $itemID, $bid ,$round, $username );
$stmt->execute();
}       
}
 }
?>

[mysqli_query](https://www.php.net/manual/en/mysqli.query.php) returns a [mysqli_result](https://www.php.net/manual/en/class.mysqli-result.php), not a single value. You'll need to get the values out of the results with the given mysqli_result methods. — aynber, Nov 09 '22 at 13:56
You should use prepared statements for *all* of your queries, not just the INSERT one's — DarkBee, Nov 09 '22 at 14:01
**Warning:** You are wide open to [SQL Injections](https://php.net/manual/en/security.database.sql-injection.php) and should use parameterized **prepared statements** instead of manually building your queries. They are provided by [PDO](https://php.net/manual/pdo.prepared-statements.php) or by [MySQLi](https://php.net/manual/mysqli.quickstart.prepared-statements.php). Never trust any kind of input! Even when your queries are executed only by trusted users, [you are still in risk of corrupting your data](http://bobby-tables.com/). [Escaping is not enough!](https://stackoverflow.com/q/32391315) — Dharman, Nov 09 '22 at 14:42
I have edited to include prepared statements and am still getting an error: array to string conversion — Avzi, Nov 09 '22 at 15:05
you have arrays, so you need for every loop to insert 1 value of that array at the time — nbk, Nov 09 '22 at 15:19

score 0 · Answer 1 · edited Nov 14 '22 at 03:32

Someone kindly helped me find the problem, I was preparing my tables wrongly. The final loop looked like this:

foreach ($newBidIds as $id){
    $insertStmt = $db->prepare("INSERT INTO BidTables (`BandName`,`BidderID`, `ItemID`, `BidPrice`, `Round`, `Username`) VALUES (?,?,?,?,?,?) ;");
    $insertStmt->bind_param("siiiis", $bandname1, $bidUserID, $itemID, $id,$round1, $username);
    $insertStmt->execute();
}

How do I loop through my array and save it to database (PHP)?

1 Answers1