如何从mysqli_fetch_array传递查询值？

Question

I am trying to insert values into a table in my database. The first param is a non null variable, the next two are the two columns I want to pass in as well. What is wrong with my logic here.

$query  = "SELECT cnum, cname FROM course WHERE specialization = '0'";  
 $result = mysqli_query($conn,$query);

 if (!$result) die ("Database access failed: " . $conn->error);

 $rows = $result->num_rows;    
for ($j =0; $j<$rows;++$j) {

     $row = mysqli_fetch_array($result);
     $query = "INSERT INTO student_schedule VALUES ('$studentID', '$row[0]', '$row[1]', '0')";

     $result = $conn->query($query);
     if (!$result) die ("Database access failed: " . $conn->error);

 }

Answer 1

Your solution

<?php
$query  = "SELECT cnum, cname FROM course WHERE specialization = '0'";  
$result = mysqli_query($conn,$query);
if (!$result) die ("Database access failed: " . $conn->error);

while ($row = mysqli_fetch_array($result)) {
    $insertQuery = "INSERT INTO student_schedule VALUES ('" . $conn->real_escape_string($studentID) . "', '" . $conn->real_escape_string($row[0]) . "', '" . $conn->real_escape_string($row[1]) . "', '0')");
    $insert = $conn->query($insertQuery);
    if (!$result) die ("Database access failed: " . $conn->error);
}
?>

Also, as a general rule, I suggest you don't mix MySQLi Procedural code with Object-Oriented code. Lastly, I also suggest you remove error outputting $conn->error , instead, capture the error and print out a custom error message instead. This reduces injection attacks.

Answer 2

Your code is vulnerable to SQL Injections , that might to be the reason why it doesn't work properly.

You should escape the data before including it into an SQL query:

for ($j =0; $j<$rows;++$j) {

    $row = mysqli_fetch_array($result);
    $query = $conn->prepare("INSERT INTO student_schedule VALUES (?, ?, ?, '0')";
    $query->bind_param('iss', $studentID, $row[0], $row[1]);
    $result = $query->execute();
    if (!$result) die ("Database access failed: " . $conn->error);

}

You can find more information on the bind_param() function in the PHP manual .