how can i enter the values of dynamic input fields into mysql db using php

Question

How can I enter the dynamically created input fields in my database using php?

Code snippet explanation:

Firstly the user enters the date1 and date2 values. The javascript code creates dynamic input fields. Then on submitting the values mysql query executes. Problem is the mysql query is not able to enter the dynamic values into database.

JS:

    function getrates() {

    var date1 = Date.parse(document.getElementById('date1').value);    //taking input from user 
        var date2 = Date.parse(document.getElementById('date2').value);// taking second input from user

        var no_of_days = ((date2-date1) / (1000 * 3600 * 24)); //calculating days b/w date1 and date2
         //document.getElementById('nod').value = no_of_days;
        var newDateColumn;
        var newRow;
        var table_columns = 2;

        for(counter = 1; counter<= no_of_days; counter++) {

            newDateColumn = document.createElement("td");
            newDateColumn.innerHTML = "Day "+counter;

            newAmtColumn = document.createElement("td");
            newAmtColumn.innerHTML = "<input type='text' class='form-contol'  name='txt"+counter+"'>";
                    newRow = document.createElement("tr");

            newRow.insertBefore(newDateColumn, newRow.appendChild(newAmtColumn));
            //newRow.appendChild(newAmtColumn);


            document.getElementById("ratetab").appendChild(newRow);
        } }

HTML:

      <label>Date1</label>
      <input  id="date1" name="date1" type="text" placeholder="yyyy/mm/dd">
      <label>Date2</label>        
      <input  id="date2" name="date2" type="text" placeholder="yyyy/mm/dd" onchange="getrates();">


    <table id="ratetab" class="table">
                        <tr>
                          <th>Date</th>
                          <th>Rates</th>
             </tr>
                       </table>

PHP:

    <?php
     $conn       = new PDO('mysql:host=localhost;dbname=ratebox', 'root', ''); //db connection
     $date1      = $_POST['date1'];
     $date2      = $_POST['date2'];
     $d1         = new DateTime("$date1");
     $d2         = new DateTime("$date1");
     $no_of_days = $d1->diff($d2)->days; //calculating no of days
     for ($x = 0; $x < $nO_of_days; $x = $x + 1) {
        $rate = $_POST['txt' + counter];
        $conn->query("insert into tb_rate(rates) values (NOW(),'$rate')") or die(mysql_error());
    }
   ?>

I am not able to enter the input values into database.

Answer 1

The below is my 2 cents on the DB only routines. I hope it is useful.

<?php
    $date1 = $_POST['date1'];
    $date1 = $_POST['date2'];
    $d1 = new DateTime("$date1");
    $d2 = new DateTime("$date1");
    $no_of_days = $d1->diff($d2)->days; //calculating no of days

    try {
        $conn = new PDO('mysql:host=localhost;dbname=ratebox', 'root', ''); //db connection
        $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); // <--- non-production mode, debug

        // figure out what some_column is below in your table
        $stmt = $dbh->prepare("INSERT INTO tb_rates (some_column,rates) VALUES (now(), :col2)");

        $stmt->bindParam(':col2', $rate);
        for ($x = 0; $x < $nO_of_days; $x = $x + 1) {
            $rate = $_POST['txt'] + counter; // <--- is that better ?
            // problem: $rate still has uncleansed user-supplied data

            // the next line probably has an error. 1 column versus 2 columns in the values():
            //$conn->query("insert into tb_rate(rates) values (NOW(),'$rate')") or die(mysql_error());

            $stmt->execute();
        }
    }
    catch (PDOException $e) {
        // non-production mode, debug
        print "Error!: " . $e->getMessage() . ".";
        die();
    }
    // when are you closing that $conn by the way? Something to think about
?>

Also don't connect with root unless in maintenance-mode. Use prepare and bind with PDO, not passing strings from user-supplied values. What is the point of using PDO otherwise?

So basically, you are combining mysql_* deprecated concepts, error trapping, with PDO, like a cut-and-paste jumble of code. Still allowing for sql-injection imo.

Answer 2

You have syntax error in your mysql query.

"insert into tb_rate(rates) values (NOW(),'$rate')"

Here you should have two parameter in as table column and you have passed only one. This query should be something like.

"insert into tb_rate(date_field, rates) values (NOW(),'$rate')"

May this help you.