How to write a general db insert function in php

Question

This question is kind of two-fold - a) am I approaching it in a valid way, and b) how would it be done in php.

I have hundreds of php forms in a legacy site, going forward I am trying to clean up the code and modularise it more.

So I am creating a database functions file, in which I would like to use a general INSERT function. Now, each form will have a totally different table, therefore different fields to insert.

I cannot find the best way to write this function - I was thinking something like this:

function insert_form_data($table, $arr_fields, $arr_values)

In this way, I am unsure how to structure the myqli query function to use the fields and values array when they are unknown.

So is this a valid way to do it, if so, please help with the syntax. Or should I spend the extra time now refactoring everything into using the mvc structure, in which case each table/form would be a 'model' etc..

thx

Kuldeep Dangi · Accepted Answer · 2015-01-14 03:54:57Z

3

A very simple example for what you want is

public function insert_form_data($table, $arr_fields, $arr_values)
{

    $sql = 'INSERT INTO '.$table.' ('.implode(", ", $arr_fields).') VALUES ('.implode(", ",  $arr_values).')';

    return mysql_query($sql);

}

you can change it accordingly if you are using PDO connection. Better if you make complete class which check connection on constructor and perform all insert update delete function.

answered Jan 14, 2015 at 3:54

Kuldeep Dangi

4,5426 gold badges36 silver badges56 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Darren Over a year ago

Maybe don't show the mysql_query() function. You'll get ridiculed very quickly because it's a deprecated library. (PDO or mysqli are the way to go here)

Kuldeep Dangi Over a year ago

I just want to show how things can be done and this is just for demonstration. that's why I mentioned to use PDO

Jessa Over a year ago

In a production environment, it is very important that $table, $arr_fields, and $arr_values be sanitized/error-checked before the query is generated and run. If these values came from user input then the example implementation would be vulnerable to a SQL injection attack.

Sanjeev Sarkar · Accepted Answer · 2015-01-14 05:17:04Z

0

Method Implementation

public function addData($_tableName, $_dataString){
    $qr_string = 'INSERT INTO `'.$_tableName.'` SET '.$_dataString;
    $this->_message = ($this->res = $this->mysqli->query($qr_string)) ? 'Success' : $this->mysqli->error ;
    return $this->_message;
}

Hope This Helps

answered Jan 14, 2015 at 5:17

Sanjeev Sarkar

418 bronze badges

Collectives™ on Stack Overflow

How to write a general db insert function in php

2 Answers 2

3 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related