Quoting a query for use in mysql_query function.

This is a queston I'm sure has turned up before, I'm just not sure where else to look for help.

Basicly, I'm building a a form on the fly from database entries, generating parts of the query to insert from this form the same way.

When the while loop to make the table has finished and is submitted I have two variables. $columns containing the column names and $data contianing the names of the variables holding the data. They are already formated right to be in a query and I put the query together like so: "INSERT INTO table ($columns) VALUES ($data)"

I know I need a stripslashes somewhere, but I'm not sure where, this is my current code for the part in queston..



The problem is what I get in my database are the variable names as data rather then the data in those variables.

When I echo my $columns and $data variables before the query and before the stripslashes() they look like so:

$columns: Q1, Q2
$data: '$QA1', '$QA2'

I'm guessing I have my stripslashes in the wrong place, or I'm missing a step. But what exactly is wrong here?

Sorry if this is a little long-winded, I wanted to make sure I didn't leave anything out.

Thanks,

have you tried modifying the string format of $data so that you don't need to strip slashes? Maybe I'm off the mark here, but this worked when I tested it (not with SQL, but it did combine with no parse errors. someone with a working SQL setup may want to check / verify)



gives me:
column1, column2
"$QA1","$QA2"
INSERT INTO db_main(column1, column2) VALUES ("$QA1","$QA2")

Unless there is some reason you can't use double quotes in inserting string data into your database, I don't see why this wouldn't work.

I tried some of that and didn't have alot of luck but I'll point out the results I got.

I found that you can use double quotes to set off data in a mysql query but it escapes the $ and you insert just the variable name. I tried that with the code below:



Where $QA1 and $QA2 both had the value test, the database entries were the variable names. I tried this both as the code above and a version of it on the mySQL command line and got the same result both times.

I also found that in order to make that work I had to run a second loop after my page refreshed from the form to construct the $data and $columns variables. Before they were constructed in the same loop that displayed the questons and then sent with a input type=hidden, I found that $data with its double quotes wasn't passing on when the page refreshed.

I'm really not sure what else to try, I'm including below all of my code after the page refreshes with the form variables. When building the $data and $column variables in the code below, the part that is there is what I originally had, while the commented out entries are ones I tried using filefrog's suggestion. Any insight as to why this isn't working and what I should do to fix it is welcome, as I'm pretty stumped.