mysql - Update column value based on PHP variable which is equal to a column name - 


$rating =  mysqli_real_escape_string($conn,$_post['rating']); $id = mysqli_real_escape_string($conn,$_post['id']); mysqli_query($conn,"update table set $rating=$rating+1 id='$id'");

is there way update column based on php variable $rating? $rating column name.

also, may prone security risks etc, i'd know if way go it.

yes can use variable name field name in sql. must validate first before putting sql string. since not field value, cannot "quote" it.

$rating =  $_post['rating']; // define list of valid "rating" db field names here $valid_fields = array('rating_a', 'rating_b', 'rating_c');  if (in_array($rating, $valid_fields)) {     $id = mysqli_real_escape_string($conn,$_post['id']);     mysqli_query($conn,"update table set $rating=$rating+1 id='$id'"); }

-

Comments

Post a Comment

Popular posts from this blog

python - Creating a new virtualenv gives a permissions error -

i'm getting following output when running virtualenv newvenv . traceback (most recent call last): file "/usr/local/bin/virtualenv", line 5, in <module> pkg_resources import load_entry_point file "/usr/lib/python2.7/dist-packages/pkg_resources.py", line 2727, in <module> add_activation_listener(lambda dist: dist.activate()) file "/usr/lib/python2.7/dist-packages/pkg_resources.py", line 700, in subscribe callback(dist) file "/usr/lib/python2.7/dist-packages/pkg_resources.py", line 2727, in <lambda> add_activation_listener(lambda dist: dist.activate()) file "/usr/lib/python2.7/dist-packages/pkg_resources.py", line 2227, in activate self.insert_on(path) file "/usr/lib/python2.7/dist-packages/pkg_resources.py", line 2334, in insert_on self.check_version_conflict() file "/usr/lib/python2.7/dist-packages/pkg_resources.py", line 2373, in check_version_conflict...
Read more

go - Idiomatic way to handle template errors in golang -

say have html/template following: <html> <body> <p>{{somefunc .somedata}}</p> </body> and somefunc returns error. there idiomatic way deal this? if write directly responsewriter , status code 200 has been written before encounter error. var tmpl *template.template func handler(w http.responsewriter, r *http.request) { err := tmpl.execute(w, data) // "<html><body><p>" has been written... // err? } preferably return status code 400 or such, can't see way if use template.execute directly on responsewriter . there i'm missing? since template engine generates output on-the-fly, parts of template preceding somefunc call sent output. , if output not buffered, (along http 200 status) may sent. you can't that. what can perform check before call template.execute() . in trivial case should enough call somefunc() , check return value. if choose path , return value of somefunc() c...
Read more

print tables with dynamic columns angularjs and ngtable -

i'm using angularjs , ngtable , wish print table dynamically generated. this code: var app = angular.module('dl', ['ngtable']); app.controller('dactrl', function($scope, ngtableparams, $http) { $scope.headers=[]; $scope.data = []; //----------------------example-------------------------- //---$scope.header[{label: "value1"},{label: "value2"},{label: "value3"}]----- //---$scope.data[{value1: 1, value2: 2, value3: 3},{value1: 18, value2: 30, value3: 6}, {value1: 15, value2: 21, value3: 56},......]-------------- //------- header y data are dynamically generated $scope.tableparams = new ngtableparams({ page: 1, count: 10, filter: { message: '' }, sorting: { asset: 'asc' ...
Read more