PDO INSERT not working with $_POST Variables - php

Question

I'm pulling my hair out over this- hopefully it's an easy oversight.
I'm planning on sending a bunch of variables to this PHP files with a jQuery AJAX function. I wrote this section to assign all $_POST variables to php variables:
foreach($_POST as $key => $value){
$$key = $value;
}
and it seems to be working, because I can manipulate the variables like so:
echo 'name: ' . $name . '<br>';
echo 'main_pic: ' . $main_pic . '<br>';
echo 'product_pic: ' . $product_pic . '<br>';
echo 'more_pic: ' . $more_pic . '<br>';
echo 'paypal_code: ' . $paypal_code . '<br>';
echo 'category_id: ' . $category_id . '<br>';
echo 'price: ' . $price . '<br>';
echo 'description: ' . $description . '<br>';
echo 'product_color: ' . $product_color . '<br>';
echo 'design_color: ' . $design_color;
So now that I have those, I want to insert them into my table-
$qry = $pdo->prepare("INSERT INTO inventory (name, main_pic, product_pic, more_pic, paypal_code, category_id, price, description, product_color, design_color)
VALUES (:name, :main_pic, :product_pic, :more_pic, :paypal_code, :category_id, :price, :description, :product_color, :design_color)");
$qry-> bindParam(':name', $name);
$qry-> bindParam(':main_pic', $main_pic);
$qry-> bindParam(':product_pic', $product_pic);
$qry-> bindParam(':more_pic', $more_pic);
$qry-> bindParam(':paypal_code', $paypal_code);
$qry-> bindParam(':category_id', $category_id);
$qry-> bindParam(':price', $price);
$qry-> bindParam(':description', $description);
$qry-> bindParam(':product_color', $product_color);
$qry-> bindParam(':design_color', $design_color);
$qry-> execute();
This doesn't run- and I'm not sure the best way to log an error to see why. If I manually assign the variables and comment out my earlier $_POST shenanigans, everything seems to work and the INSERT runs fine.
Any clues? I thought it might be because the database is expecting certain variable type, but I think I've fully explored that.
Anyone know of any reasons that manually assigning the variables would work but grabbing them from $_POST wouldn't?
EDIT: following those suggestions, I've got an error message
SQLSTATE[23000]: Integrity constraint violation: 1062 Duplicate entry '0' for key 1
Alright, so I'm not assigning a unique Primary key when I'm trying this insert- I was under the assumption that PDO would handle that. What is the best way to handle assigning a unique Primary key? I'd like to avoid having the user manually assign it.

Answer 1

This is not an answer, but it will look better than a comment. Why are you doing the following:
foreach($_POST as $key => $value){
$$key = $value;
}
This is register globals all over again (sort of). With above code you can easily overwrite local variables with unexpected results or even worse introduce security vulnerabilities.
What if I post $_POST['is_admin'] = 1 or something like that? Either way I think you get the idea. What you just did is bad and can be dangerous.

Answer 2

Like #PeeHaa, this is not an answer, but to expand on my comment on his; drop the pseudo register globals functionality: opt for a white-list of fields, and coordinate the names with those posted.
$fields = ['name', 'age', 'sex'];
$query = $pdo->prepare(sprintf('INSERT INTO `table` (%s) VALUES (%s)',
implode(',', $fields),
implode(',', array_map(function($field) {
return ":{$field}";
}, $fields))));
foreach($fields as $field) {
$query->bind(":{$field}", $_POST[$field]);
}
$query->execute();
Obviously, this needs more validation, empty() checking, etc., but you get the idea. Furthermore, you can add more validation/sanitization with a callback lookup:
$sanitizers = [
'sex' => function($value) {
$value = strtolower($value);
return in_array($value, ['male', 'female', 'unknown'])
? $value : 'unknown';
},
];
foreach($sanitizers as $field => $sanitizer) {
if (isset($_POST[$field])) {
$_POST[$field] = $sanitizer($_POST[$field]);
}
}
If post contains "genderless" for "sex", you'll get "unknown" instead.
More complete example:
// whitelist keys and sanitizer values
$fields = [
// limit to 255
'name' => function($value) {
return substr($value, 0, 255);
},
// you can't be that old
'age' => function($value) {
return min(max((int) $value, 0), 100);
},
// starfish need not apply
'sex' => function($value) {
$value = strtolower($value);
return in_array($value, ['male', 'female', 'unknown'])
? $value : 'unknown';
},
];
// build ye' old query
$query = $pdo->prepare(sprintf('INSERT INTO `table` (%s) VALUES (%s)',
implode(',', array_keys($fields)),
implode(',', array_map(function($fields){
return ":${$field}";
}, array_keys($fields)))));
// loop dee doop to sanitize and bind
foreach ($fields as $key => $sanitizer) {
if (is_callable($sanitizer)) {
$query->bind(":{$field}", $sanitizer($_POST[$field]));
continue;
}
$query->bind(":{$field}", $_POST[$field]);
}
// fire the cannons!
$query->execute();

Answer 3

Empty your database table and see if it works... Likely you have a primary key in your db table that you are trying to overwrite.
Check your db table as well, using EXPLAIN inventory

Answer 4

If you want, you can have an autoincremented primary key. Supposing you use mysql:
http://dev.mysql.com/doc/refman/5.0/en/example-auto-increment.html

Answer 5

The OP said:
Alright, so I'm not assigning a unique Primary key when I'm trying
this insert- I was under the assumption that PDO would handle that.
What is the best way to handle assigning a unique Primary key? I'd
like to avoid having the user manually assign it.
Just addressing this part or your question - you just use an unquoted 0
insert into table (id, name) values (0, 'Bob');
But as you say, you should not have to if it is an id which is auto-incrementing correctly.
In old versions of Mysql (< 5) you could use an empty string, which blew up when 5.0 came out, just in case anyone reading this fell foul of that previously undocumented feature.