SQL array values in php

Hi I'm really new to php/mysql.

I'm working on a php/mysql school project with 39 fields all in all in a single table. I want to shorten my codes especially on doing sql queries.

$sql = "INSERT into mytable ('field_1',...'fie开发者_如何学编程ld_39') Values('{$_POST['textfield_1']}',...'{$_POST['textfield_39']}')";

I don't know how to figure out this but , i want something like:

$sql = "Insert into mytable ("----all fields generated via loop/array----")  Values("----all form elements genrated via loop/array---")";

Thank you in advance.

<?php
function mysql_insert($table, $inserts) {
$values = array_map('mysql_real_escape_string', array_values($inserts));
$keys = array_keys($inserts);

return mysql_query('INSERT INTO `'.$table.'` (`'.implode('`,`', $keys).'`) VALUES      (\''.implode('\',\'', $values).'\')');
}
?>

For example:

<?php`enter code here`

   mysql_insert('cars', array(
   'make' => 'Aston Martin',
   'model' => 'DB9',
   'year' => '2009',
   ));
  ?>

  try this it i thhink it il work

You could use implode:

$sql = "
INSERT into mytable 
('" . implode("', '", array_keys($_POST) . "') 
VALUES
('" . implode("', '", $_POST . "')";

(This assumes the indices of the POST array are also the names of the db table fields)

However, this is extremely insecure since you would directly insert post data into the database.

So the least you should do beforehand is escape the values and make sure they are ok/valid table fields:

// Apply mysql_real_escape_string to every POST value
array_walk($_POST, "mysql_real_escape_string");

and

// Filter out all POST values with invalid indices
$allowed_fields = array('field_1', 'field_2', /* ... */ );
$_POST = array_intersect_key($_POST, $allowed_fields);

<?php
  $sql = "Insert into mytable (";

  for ($i = 1; $i < 40; $i++) {
      if ($i == 39) {
          $sql .= "field_$i";
      } else {
          $sql .= "field_$i,";
      }
  }

  $sql .= "Values(";



  for ($i = 1; $i < 40; $i++) {
      if ($i == 39) {
          $sql .= "'" . $_POST[textfield_$i] . "'";
      } else {
          $sql .= "'" . $_POST[textfield_$i] . "',";
      }
  }
?>

< ?php $sql = "Insert into mytable (";

for ($i = 1; $i < 40; $i++) {

  if ($i == 39) {

      $sql .= "field_$i";

  } else {

      $sql .= "field_$i,";

  }

}

$sql .= "Values(";

for ($i = 1; $i < 40; $i++) { if ($i == 39) { if(is_int($POST[textfield$i])){ $sql .= $POST[textfield$i]; } else{ $sql .= "'" . $POST[textfield$i] . "'"; }

  } else {
       if(is_int($_POST[textfield_$i])){
           $sql .= $_POST[textfield_$i] .",";
       }
       else{
           $sql .= "'" . $_POST[textfield_$i] . "',";
        }  

  }

} ?>

it will work for numeric values. you can insert numeric values in single quotes but some times it will create some problems