Auto grab ID function? - php

Question

Alright so I have two tables that I am working with.
The first is set up something like these tables
Destination
IDDestination Name IDCity IDState
1 Scottsdale 3 4
2 Miami 5 7
and
Destinations_Citites
IDDestinationCity IDDestination IDCity
1 1 3
2 2 5
Now with my plugin I have an add a new destination button which adds a new destination with its Name, IDCity and IDState filled out by the user and the IDDestination is automatically generated.
So what I want to figure out how to do is to grab that automatically generated IDDestination # and enter it into the Destinations_Cities table with out having the user do anything else.
Basically how can I insert the automatically generated IDDEstination that was just created and throw it into my other table without the user having to add it themselves.
Here is the code I am using to Insert and Update for my add destinations button
if(isset($_POST['Add_Destination'])) {
$idstate = $_POST['idstate1'];
$idcity = $_POST['idcity'];
$name = $_POST['addname'];
$SQL="INSERT INTO destination (name, IDCity, IDState) VALUES ('". $name ."','". $idcity ."','". $idstate ."')";
$SQL1="UPDATE city SET is_active='1' WHERE IDCity='$idcity'";
$result=mysql_query($SQL) or die (mysql_error());
$result1=mysql_query($SQL1) or die (mysql_error());
print $SQL;
print $SQL1;
}

Answer 1

You can get the most recent auto-increment id generated during your session:
$dest_id = mysql_insert_id();
Refer to the documentation: http://php.net/manual/en/function.mysql-insert-id.php
Not exactly about your question, but I echo the comment above that you should protect your queries from SQL injection vulnerabilities. Don't copy PHP variables into SQL strings unless you have made sure the variables are made safe.
If a variable is supposed to be an integer, use (int) to cast it to an integer as you read it.
For string values, use escaping provided by the MySQL API.
Also, there's no need to do all the . concatenation if you're just putting simple variables inside PHP strings. There's no need in SQL to put quotes around integer literals.
Here's an example:
if(isset($_POST['Add_Destination'])) {
$idstate = (int) $_POST['idstate1'];
$idcity = (int) $_POST['idcity'];
$name = mysql_real_escape_string($_POST['addname']);
$SQL="INSERT INTO destination (name, IDCity, IDState)
VALUES ('$name', $idcity, $idstate)";
$dest_id = mysql_insert_id();
$SQL1="UPDATE city SET is_active='1' WHERE IDCity='$idcity'";
. . .
If you convert your code to use PDO, you can use SQL query parameters, in which case you wouldn't need to worry about escaping and such.