SQL stacking results in a group for HTML Table in a single line

Question

I have a php program that inserts values from SMS messages coming in via HTTP POST to a database. The incoming messages are stored into $Body variable. I'm trying to make a HTML table that shows the table having one entry and grouping by the incoming number. Here is the code that inserts the entry to the database:

// Create connection
$conn = mysqli_connect($servername, $username, $password, $dbname);
// Check connection
if (!$conn) {
die("Connection failed: " . mysqli_connect_error());
}

if (stristr($Body, '1A') !== false || stristr($Body, '1B') !== false || 
stristr($Body, '2A') !== false || stristr($Body, '2B') !== false || 
stristr($Body, '3A') !== false || stristr($Body, '3B') !== false || 
stristr($Body, '4A') !== false || stristr($Body, '4B') !== false || 
stristr($Body, '5A') !== false || stristr($Body, '5B') !== false){
$sql = "INSERT INTO Lunch_Database (fromnum, tonum, sms_order, sms_table, 
sms_sid)
VALUES ( '$From' , '$To' , '' , '$Body' , '$SmsSid')";
}

if (stristr($Body, 'fish') !== false || stristr($Body, 'beef') !== false || 
stristr($Body, 'chicken') !== false ){
$sql = "INSERT INTO Lunch_Database (fromnum, tonum, sms_order, sms_table, 
sms_sid)
VALUES ( '$From' , '$To' , '$Body' , '' , '$SmsSid')";
}


if (mysqli_query($conn, $sql)) {
//echo "New record created successfully"; echo can't work with sending SMS
} else {
//echo "Error: " . $sql . "<br>" . mysqli_error($conn);
}
}
mysqli_close($conn);
$intro = "<?xml version='1.0' encoding='UTF-8'?>
<Response>
<Sms>Hey there, Welcome to Avaya Cloud Whats4Lunch application. What would 
you like for lunch? Please reply with Fish, Chicken or Beef</Sms>
</Response>";

$rownum = "<?xml version='1.0' encoding='UTF-8'?>
<Response>
<Sms>Which row number and letter are you in? Ex. 5A or 5B</Sms>
</Response>";

$thanks = '<?xml version="1.0" encoding="UTF-8"?>
<Response>
<Sms>Thank you, your lunch order has been submitted.</Sms>
</Response>';

if (stristr($Body, 'lunch') !== false){
print $intro;
}
if (stristr($Body, 'fish') !== false || stristr($Body, 'beef') !== false || 
stristr($Body, 'chicken') !== false ){
print $rownum;
}
if (stristr($Body, '1A') !== false || stristr($Body, '1B') !== false || 
stristr($Body, '2A') !== false || stristr($Body, '2B') !== false || 
stristr($Body, '3A') !== false || stristr($Body, '3B') !== false || 
stristr($Body, '4A') !== false || stristr($Body, '4B') !== false || 
stristr($Body, '5A') !== false || stristr($Body, '5B') !== false){
print $thanks;
}

After the entire SMS interaction this inserts this into the database from one person:

What I want is all my entries to be saved on the same line in the database.

SELECT * FROM Lunch_Database GROUP BY fromnum should show one line with both sms_order and sms_table and collect them together.

UPDATE: I have no choice but to insert the rows separately as SMS messages are received to the $Body variable. I want to merge content from each row to make one row.

Let me know if this is possible. Thanks, Phillip K

Answer 1

Right now you're inserting two separate rows when what you want to do is insert a new row once, then modify the existing row on the second pass.

That would look something like

UPDATE Lunch_Database SET sms_table = :table WHERE fromnum = :phone_num

This way, instead of ignoring the previous entry, we search for it to update the previously created entry. Also, you may need to add more columns to the database; if the user returns for another meal, the system would assume the previous order information. This might manifest as a field to retain order time as a form of session.

You should seriously consider scrapping the mysqli_query and go for prepared statements . If nothing else, use mysqli_real_escape_string . At the moment, it looks like your setup would be open to sql injection.