Inserting Multiple Rows by Form into a Single DB - php

Question

First time doing this, watch it be a really obvious/easy fix...
Basically I'm trying to insert multiple rows with a single insert query, however, I clearly fail and as such it wont work.
The form is generated by searching a table for the relevant entries it relates to, so if your in department A it will grab your name and form an input line on the form. This all works fine I can generate the form however the issue them comes when I try to insert the form.
Currently it does this thing where rather than inserting the data entered via the form it is entering the letter A across most fields (COUNT, STATUS and TYPE are immune to this as they are restricted to only certain data types via the tables set up itself).
This is currently how I have the form set in the script:
<?php
if ($action == "editrecord") {
?>
<form name="form1" method="post" action="">
<table>
<tr><td colspan="2" align="left">
<?php //Getting Title for Record
$resultTITLE = queryDB("SELECT * FROM merit_subdepts WHERE subdeptID = '$subdeptID'");
while($rowTITLE = mysql_fetch_array($resultTITLE)) {
$recordTITLE = $rowTITLE["subdeptNAME"];
echo "$recordTITLE";
}
?>
</td></tr>
<tr><td>Member Name</td><td>Choose Award</td><td>Reason</td><td></td></tr>
<?php
$resultMERIT = queryDB("SELECT * FROM merit_members WHERE memberPRIMARY = '$subdeptID'");
while($rowMERIT = mysql_fetch_array($resultMERIT)) {
$memberID = $rowMERIT["memberID"];
$memberNAME = $rowMERIT["memberNAME"];
?>
<tr>
<td><?php echo $memberNAME; ?></td>
<td><select name="count[]" class="ui-state-default">
<option value="0">0</option>
<option value="1">1</option>
<option value="2">2</option>
<option value="3">3</option>
<option value="4">4</option>
<option value="5">5</option>
<option value="6">6</option>
</select>
</td>
<td><input name="reason[]" type="text" id="reason" class="blackInput" value="Monthly Award <?php echo date("F, Y") ?>"></td>
<td><input name="type[]" type="hidden" id="type" value="Civil">
<input name="awarder[]" type="hidden" id="awarder" value="<?php $usersname; ?>">
<input name="datea[]" type="hidden" id="datea" value="<?php $stamp83; ?>">
<input name="status[]" type="hidden" id="status" value="Check">
<input name="id[]" type="hidden" id="id" value"<?php $memberID; ?>">
<input name="dept[]" type="hidden" id="dept" value"<?php $recordTITLE; ?>">
</td>
</tr>
<?php } //end of sub-division membership list ?>
<tr><td colspan="4"><center>
<div class="butDiv"><input name="submitRECORDS" type="submit" id="submitRECORDS" value="Submit Records"></div>
</center>
</td>
</tr>
</table>
</form>
<?php
} //End of Edit Merit Records
?>
This is the insert query used:
if ($submitRECORDS) {
for($i = 0; $i<count($_POST['id']); $i++) //Getting total # var submitted and running loop
{ $fromID = $_POST['id'][$i]; //var
$fromTYPE = $_POST['type'][$i]; //var
$fromCOUNT = $_POST['count'][$i]; //var
$fromDATEA = $_POST['datea'][$i]; //var
$fromAWARDER = $_POST['awarder'][$i]; //var
$fromREASON = $_POST['reason'][$i]; //var
$fromDEPT = $_POST['dept'][$i]; //var
$fromSTATUS = $_POST['status'][$i]; //var
if ($fromID != "0") {
queryDB("INSERT INTO merit_precord (NAME,TYPE,COUNT,DATEA,AWARDER,REASON,DEPT,STATUS) VALUES ('$fromID','$fromTYPE','$fromCOUNT','$fromDATEA','$fromAWARDER','$fromREASON','$fromDEPT',$fromSTATUS')"); } }
$action="";
$msg=1;
}
Assistance much appreciated before I rip my hair out. :)

Answer 1

This may not be the only source of your problems (only the first I notice), but when using <?php $varname ?>, nothing will actually be printed to the screen. Instead you need to use <?php echo $varname; ?>
<td><input name="type[]" type="hidden" id="type" value="Civil">
<input name="awarder[]" type="hidden" id="awarder" value="<?php echo $usersname; ?>">
<input name="datea[]" type="hidden" id="datea" value="<?php echo $stamp83; ?>">
<input name="status[]" type="hidden" id="status" value="Check">
<input name="id[]" type="hidden" id="id" value"<?php echo $memberID; ?>">
<input name="dept[]" type="hidden" id="dept" value"<?php echo $recordTITLE; ?>">
</td>
The A you're seeing inserted is the first letter of Array. When the above values are inserted empty and you try to access them in the for loop with [], the string Array is accessed by character index like an array.
Your INSERT statements, as mentioned in comments, are vulnerable to SQL injection. Escape them with mysql_real_escape_string().
$fromID = mysql_real_escape_string($_POST['id'][$i]);
$fromTYPE = mysql_real_escape_string($_POST['type'][$i]);
$fromCOUNT = mysql_real_escape_string($_POST['count'][$i]);
...
...
$fromSTATUS = mysql_real_escape_string($_POST['status'][$i]);