Insert to a table using a string that is created in a separate function

Question

I'm trying to insert using a string that is created in a separate function but it does not appear to be working.

I know I should be using a switch statement or something for this but it is purely for testing at the moment.

<?php
function newItem($link){
    $itemname = mysqli_real_escape_string($link, $_POST['itemname']);
    if (strpos($itemname,'<') || strpos($itemname,'>') || strpos($itemname,'?') || strpos($itemname,'/') || strpos($itemname,'=')) 
    {
        echo "<script type='text/javascript'>alert('yeah....no');</script>";
    } else { 
        $sql = "SELECT * FROM items WHERE itemname = '$itemname'";
        $result = mysqli_query($link,$sql);
        if(mysqli_num_rows($result) !== 1){
            $sql = "INSERT INTO items(itemname,itemtype,attack,defence,energy)VALUES('$itemname'".RandomStats($link).")";
            mysqli_query($link,$sql);
            header("location: index.php");
        }else{
            echo "<script type='text/javascript'>alert('Item name already exists');</script>";
        }
    } 
}
function RandomStats($link){
    $rand = rand ( 1 , 100 );
    $itemtype = rand (1,3);
    $itemtypeString;

    if($itemtype = 1){
        $itemtypeString = 'Armour';
    }
    if($itemtype = 2){
        $itemtypeString = 'Sword';
    }
    if($itemtype = 3){
        $itemtypeString = 'Shield';
    }

    if($rand <= 50){
        //common
        $attack = rand (1 , 50);
        $defence = rand (1 , 50);
        $energy = rand (1 , 50);
        $ItemStats = "','".$itemtypeString."','".$attack."','".$defence."','".$energy."'";
    }
    if ($rand >50 and $rand <= 80){
        //rare
        $attack = rand (1 , 100);
        $defence = rand (1 , 100);
        $energy = rand (1 , 100);
        $ItemStats = "','".$itemtypeString."','".$attack."','".$defence."','".$energy."'";
    }
    if ($rand >80 and $rand <= 98){
        //exotic
        $attack = rand (1 , 150);
        $defence = rand (1 , 150);
        $energy = rand (1 , 150);
        $ItemStats = "','".$itemtypeString."','".$attack."','".$defence."','".$energy."'";
    }
    if ($rand >98 and $rand <= 100){
        //ledgendary
        $attack = rand (1 , 200);
        $defence = rand (1 , 200);
        $energy = rand (1 , 200);
        $ItemStats = "','".$itemtypeString."','".$attack."','".$defence."','".$energy."'";
    }

    return $ItemStats;
}
?>

is it just that the way I'm creating the string I'm making the statement incorrect or is it something else?

Answer 1

在进行u_mulder帮助我进行的调试后，我一开始不需要额外的'