将NULL附加到字符串，用于MySQL插入查询

Question

I am trying to add a new entry to a MySQL database, with last 5 parameters being optional, so NULL value is possible. I am having trouble appending NULL value to a query string, based on received POST data.

How to append NULL value to a query string?

//more similar mysqli_real_escape_string rows and if clauses above these lines
$phonenumber=mysqli_real_escape_string($db,$_POST["phonenumber"]);
$gender = NULL;
if($_POST["gender"] != null)
   $gender=(int)mysqli_real_escape_string($db,$_POST["gender"]);
$age = NULL;
if($_POST["age"] != null)
   $age = (int)mysqli_real_escape_string($db,$_POST["age"]);
$qs_registration="insert into uporabnik (ID, up_ime, geslo, email, ime, priimek, naslov_bivanja, posta_foreign_key,
tel_stevilka, spol, starost) VALUES (NULL, '".$username."','".$password."','".$email."','".$name."',
'".$surname."','".$location."',".$postoffice.",'".$phonenumber."',".$gender.",".$age.")";

Answer 1

If you need a null value eg: are using and auto_increment id ..in a column then you could omit the related values (and you can avoid the string concat because '$yourvar' is enough)

    "insert into uporabnik (up_ime, geslo, email, ime, priimek, 
      naslov_bivanja, posta_foreign_key, tel_stevilka, spol, starost)
    VALUES ('$username','$password','$email','$name',
         '$surname','$location', $postoffice','$phonenumber',$gender,$age.")";

anyway be careful passing var you should eval a paramaetrized query instead passing var for avoid sqlinjection

Answer 2

First of all, you should be using prepared statements - When should I use prepared statements?

However, if you are just looking for an answer, just set your initial variables to the string 'NULL' instead.

That way, when you concat everything, you'll get a query string that MySQL can understand:

$age = 'NULL';
if($_POST["age"] != null) {
    // Wrap each variable in quotes
   $age = "'" . (int)mysqli_real_escape_string($db,$_POST["age"]) . "'";
}
// etc.

$qs_registration="insert into uporabnik (ID, up_ime, geslo, email, ime, priimek, naslov_bivanja, posta_foreign_key,
tel_stevilka, spol, starost) VALUES (NULL, " . $username . "," . $password . "," . $email . "," . $name . ",
" . $surname . "," . $location . "," . $postoffice . "," . $phonenumber . "," . $gender . "," . $age . ")";

NOTE : I think there are a lot of other problems here, from not using prepared statements (as mentioned before) to how you have the table configured in the first place. But this should fix your issue at hand.