Posting empty results - php

Question

Hello i am trying to make a trade script were users can trade each others monsters.
So i have a script were it shows there monsters and the users monsters that they type in so if the user types in nick it will shows the pokemon nick monsters and the user who typed it in monster.
All of whic works fine it displays what i want.
Now i want to store the monsters they want and are offering in the db. And that is were we come to the problem. For some resosn its storing the username and the username of the trader ok but not the monsters. Its storing
{"pokemon":[""]}
For the trade_pokeid and the trade_mypokeid
Here is how i display there monsters and the users monsters which works fine
Trade with </h4>
<?php
$username_trade = $_POST['username_trade'];
$_SESSION['username_trade'] = $username_trade ;
echo "You put in id ". $username_trade . ".<br />";
?>
</p>
<p> </p>
<p><span class="mid_box">
<?php
// get and display userbox
$q = "SELECT id,pokemon,exp,level FROM user_pokemon WHERE belongsto='". $_SESSION['username_trade']."'";
$r = mysql_query($q);
if (mysql_num_rows($r) <= 0) {
echo "You have no current pokemon stored";
}
?>
</span></p>
<p> </p>
<p>
<?php
echo "<form action='test_process.php' method='POST'>";
while ( $v = mysql_fetch_object( $r ) )
{
echo "<label><input type='checkbox' name='pokemon[]' value='$v->dbid'/> They have a $v->pokemon </label><br/>";
echo "<label> Level $v->level </label><br/>";
}
echo "<input type='hidden' name='user' value='$username_trade'/>";
echo "<input type='submit' value='Check!!'/>";
?>
</p>
<p><strong>Pick what you want two offer for the pokemon </strong></p>
<p>
<?php
// get and display userbox
$q = "SELECT id,pokemon,exp,level FROM user_pokemon WHERE belongsto='". $_SESSION['username']."'";
$t = mysql_query($q);
if (mysql_num_rows($t) <= 0) {
echo "You have no current pokemon stored";
}
?>
</p>
<p>
<?php
echo "<form action='test_process.php' method='POST'>";
while ( $v = mysql_fetch_object( $t ) )
{
echo "<label><input type='checkbox' name='pokemonin[]' value='$v->dbid'/> I have a $v->pokemon</label><br/>";
echo "<label> Level $v->level </label><br/>";
}
echo "<input type='hidden' name='userin' value='$username'/>";
echo "</form>";
?>
<p align="center">
Now here is how i try and store them.
<?php
include 'config.php';
$pokemon = $_POST['pokemon'];
$pokemonin = $_POST['pokemonin'];
$meid = $_SESSION['username'];
$toid = $_POST['user'];
$dbid = array();
$dbid2 = array();
foreach ( $pokemon as $poke )
{ $dbid['pokemon'][] = $poke;
}
foreach ( $pokemonin as $poke2 )
{ $dbid2['pokemonin'][] = $poke2;
}
srand ((double) microtime( )*1000000);
$random_number = rand( );
echo "$random_number";
mysql_query("INSERT INTO trade (trade_id, trade_to, trade_from, trade_pokeid, trade_mypokeid)
VALUES ('$random_number','$toid', '$meid', '"$dbid."', '".$dbid2."');") or die("Error: ". mysql_error());
?>
What am i doing wrong ? why are the results not being stored ? or carried over the db connect and session start are in the config.php page

Answer 1

In your last MySQL query, you're trying to insert a PHP array as a string into a query, that won't work. If I'm guessing correctly, you'll want to use something like implode(",",$dbid['pokemon']) instead of $dbid.
Also, it's definitely a good idea to run mysql_real_escape_string on anything that comes from the user and/or the URL before you put it in a query!

Answer 2

Your code is open for sql injection !
You shuld aviod passing parameters (without escaping) to sql query => for start check:
http://php.net/manual/en/function.mysql-real-escape-string.php

Answer 3

You have an error (not enough - or too many dots) in your MYSQL statement...
VALUES ('$random_number','$toid', '$meid', '"$dbid."', '".$dbid2."')
Should read
VALUES ('$random_number','$toid', '$meid', '$dbid', '$dbid2')