Inserting PHP and XML into MYSQL - php

Question

I am using the below code to draw data from our service provider for LBS. What i am trying to do is also load this information that i receive into mysql.
Using this code I am not getting any errors, and the location and map API's are working great but it is not placing the data drawn into mysql at all.
<?php
function parseXML($fstr,$tstr_start,$tstr_end) {
if ( ! strstr($fstr,$tstr_start) || !strstr($fstr,$tstr_end) ){
return ;
}
$start = strpos($fstr,$tstr_start) + strlen($tstr_start);
$stop = strpos($fstr,$tstr_end, $start);
$length = $stop - $start;
return trim(substr($fstr, $start, $length));
}
define ("MAP_API_KEY","***");
define ("MAP_BASE_URL","http://maps.googleapis.com/maps/api/staticmap?");
$Data = $GLOBALS["HTTP_RAW_POST_DATA"];
//--- Get XML data into variables
$DataAry['ResponseType'] = parseXML($Data,'Response Type="','"');
$DataAry['RefNo'] = parseXML($Data,'RefNo="','"');
$DataAry['SeqNo'] = parseXML($Data,'SeqNo="','"');
$DataAry['Network'] = parseXML($Data,'<NetworkID>','</NetworkID>');
$DataAry['Lat'] = (int) parseXML($Data,'<Lat>','</Lat>');
$DataAry['Lon'] = (int) parseXML($Data,'<Lon>','</Lon>');
$DataAry['Accuracy'] = parseXML($Data,'<Accuracy>','</Accuracy>');
$DataAry['DateTime'] = parseXML($Data,'<DateTime>','</DateTime>');
$DataAry["Lat"] = $DataAry['Lat']/1000000;
$DataAry["Lon"] = $DataAry["Lon"]/1000000;
$con = mysql_connect("localhost","****","****");
if (!$con)
{
die('Could not connect: ' . mysql_error());
}
mysql_select_db("****", $con);
$sql="INSERT INTO trace (Lat, Lon, DateTime, RefNo)
VALUES
('$_POST[Lat]','$_POST[Lon]','$_POST[DateTime]','$_POST[RefNo]')";
if (!mysql_query($sql,$con))
{
die('Error: ' . mysql_error());
}
// ---Create link to map
$link = MAP_BASE_URL . "center={$DataAry['Lat']},
{$DataAry['Lon']}&zoom=15&size=500x500&key=" . MAP_API_KEY . "&sensor=true&markers=
{$DataAry['Lat']},{$DataAry['Lon']}";
$handle = fopen("requests.php","c");
fwrite($handle, "<br/>Location Request # ". date("Y-m-d H:i:s") . "<br/><textarea
style='width:500px;height:200px' readonly>" . $GLOBALS["HTTP_RAW_POST_DATA"] . "
</textarea><br/><img style='border:1px solid #000;width:500px;height:500px'
src='$link'/><hr/>");
fclose ($handle);
echo "done!";
?>
It does however throw it into the requests.php page as requested but i need to extract the info into msql

Answer 1

The first problem is that there are no quotes around your string key indexes for your $_POST array. You might want to put !mysql_query($sql,$con) in a try-catch to see if you catch any errors then. Also the use of mysql_* functions in PHP is deprecated and should not be used anymore. Because you are using the mysql_* functions, you are also vulnerable to SQL-injections.