mysqli参数中的空值

Question

my mysql table accepts NULL values on many fields, I'm updating records and my desktop app is creating a http string as follows and sending to a php script.

www.webpage/script.php?firstval=48.345345&secondval=234&thirdval=&fourthval=simon

on the db thirdval is already NULL but the parameters in the http string may or may not hold values

do I need to : A)pass the parameter in the http string as b)pass the parameter in the httpstring as c)cater for the null value in the php script( d)not include the parameter in the http string at all or something else my phpscript is like so :

 ?php

DEFINE ('DBUSER', 'generic01');
DEFINE ('DBPW', 'genpass');
DEFINE ('DBHOST', 'mysql4.xxxxxxxxx.com'); 
DEFINE ('DBNAME', '_Places');


$dbc = mysqli_connect(DBHOST,DBUSER,DBPW);
if (!$dbc) {
die("Database connection failed: " . mysqli_error($dbc));
exit();
}

$dbs = mysqli_select_db($dbc, DBNAME);
if (!$dbs) {
die(" Database selection bit failed: " . mysqli_error($dbc));
exit();
}
$lat = mysqli_real_escape_string($dbc, $_GET['lat']);
$lng = mysqli_real_escape_string($dbc,$_GET['lng']);
$prox = mysqli_real_escape_string($dbc,$_GET['prox']);
$description = mysqli_real_escape_string($dbc,$_GET['description']);
$id = mysqli_real_escape_string($dbc,$_GET['id']);
$direction = mysqli_real_escape_string($dbc,$_GET['direction']);
$avoiddays = mysqli_real_escape_string($dbc,$_GET['avoiddays']);
$validfrom = mysqli_real_escape_string($dbc,$_GET['validfrom']);
$validto = mysqli_real_escape_string($dbc,$_GET['validto']);
$gefid = mysqli_real_escape_string($dbc,$_GET['gefid']);
$expiry = mysqli_real_escape_string($dbc,$_GET['expiry']);


$query = "UPDATE places SET rt_lat = '$lat',rt_lng= '$lng',rt_prox = '$prox', rt_description = '$description', rt_direction = '$direction',rt_avoiddays = '$avoiddays',rt_validto = '$validto',rt_validfrom = '$validfrom',rt_gefid = '$gefid',rt_expiry='$expiry' WHERE rt_id = '$id'"; 

$result = mysqli_query($dbc, $query) or trigger_error("Query MySQL Error: " . mysqli_error($dbc));


mysqli_close($dbc);
?>

All help appreciated,

Answer 1

PHP has no knowledge of SQL nulls. If you want a blank/not-set $_GET value to become a null in the DB, then you have to take special steps:

if(isset($_GET['lat']) || ($_GET['lat'] == '')) {
   $lat = 'NULL'; // a plain PHP string with the word "null" in it
} else {
   $lat = "'" . mysqli_real_escape_string($dbc, $_GET['lat']) . "'"; // note the extra quotes
}

$sql = "INSERT ... VALUES ($lat, ....)"

If you do it any other way, eg (just as an example, yes it's sql-injection vulnerable):

$sql = "INSERT ... VALUES ('$_GET[lat]', ...)";

Then for an empty $_GET['lat'] your query would actually be

INSERT ... VALUES ('', ...)

and you'd be inserting an empty string, NOT an sql null.

Answer 2

You do not need to include it in the http request, but you have to catch that, otherwise you get an E_NOTICE error.

For all fields that can be null:

if (isset($_GET['gefid'])) {
  $gefid = mysqli_real_escape_string($dbc,$_GET['gefid']);
} else {
  $gefid = null;
}