Forum Moderators: coopster
$avail = GetSQLValueString($_POST['avail'], "text");
$num_days = GetSQLValueString($_POST['num'], "int");
// Oh, and be sure to DO THIS!
if (! ($num_days > 0)) {
die("Invalid date"); // the preference would be to return to the form
}
//
// Malicious input containing anything but numbers calculates to zero
if (($_POST['dt_month'] > 0) and ($_POST['dt_day'] > 0) and ($_POST['dt_year'] > 0)) {
$date = "$_POST['dt_month']-$_POST['dt_day']-$_POST['dt_year']";
}
else { die("Invalid date"); } // return to form with error!
//
// Note ZERO and LESS THAN. This is so the first time through,
// it DOES NOT increment the date.
//
for ($i=0;$i<$num_days;$i++) {
$date_calc = "date_add('$date',interval $i day)";
$num = $i+1;
$insertSQL = "INSERT INTO fawltytours (`day`, pax1, avail) VALUES ($date_calc,'$num','$avail');
$Result1 = mysql_query($insertSQL) or die(mysql_error());
// be sure to take mysql_error off after going live
}