PHP Conference Nagoya 2025

    pg_insert

    (PHP 4 >= 4.3.0, PHP 5, PHP 7, PHP 8)

    pg_insert — Insert array into table

    Description

    pg_insert(
        PgSql\Connection $connection,
        string $table_name,
        array $values,
        int $flags = PGSQL_DML_EXEC
    ): PgSql\Result|string|bool

    pg_insert() inserts the values of values into the table specified by table_name.

    If flags is specified, pg_convert() is applied to values with the specified flags.

    By default pg_insert() passes raw values. Values must be escaped or the PGSQL_DML_ESCAPE flag must be specified in flags. PGSQL_DML_ESCAPE quotes and escapes parameters/identifiers. Therefore, table/column names become case sensitive.

    Note that neither escape nor prepared query can protect LIKE query, JSON, Array, Regex, etc. These parameters should be handled according to their contexts. i.e. Escape/validate values.

    Parameters

    connection

    An PgSql\Connection instance.

    table_name

    Name of the table into which to insert rows. The table table_name must at least have as many columns as values has elements.

    values

    An array whose keys are field names in the table table_name, and whose values are the values of those fields that are to be inserted.

    flags

    Any number of PGSQL_CONV_OPTS, PGSQL_DML_NO_CONV, PGSQL_DML_ESCAPE, PGSQL_DML_EXEC, PGSQL_DML_ASYNC or PGSQL_DML_STRING combined. If PGSQL_DML_STRING is part of the flags then query string is returned. When PGSQL_DML_NO_CONV or PGSQL_DML_ESCAPE is set, it does not call pg_convert() internally.

    Return Values

    Returns true on success or false on failure.. Or returns a string on success if PGSQL_DML_STRING is passed via flags.

    Errors/Exceptions

    A ValueError is thrown when the specified table is invalid.

    A ValueError or TypeError is thrown when the value or type of field does not match properly with a PostgreSQL's type.

    Changelog

    Version Description
    8.3.0 Now throws a ValueError error when the specified table is invalid; previously an E_WARNING was emitted.
    8.3.0 Now throws a ValueError or TypeError error when the value or type of field does not match properly with a PostgreSQL's type; previously an E_WARNING was emitted.
    8.1.0 Returns an PgSql\Result instance now; previously, a resource was returned.
    8.1.0 The connection parameter expects an PgSql\Connection instance now; previously, a resource was expected.

    Examples

    Example #1 pg_insert() example

    <?php
    $dbconn     = pg_connect('dbname=foo');
    // This is safe somewhat, since all values are escaped.
    // However PostgreSQL supports JSON/Array. These are not
    // safe by neither escape nor prepared query.
    $res = pg_insert($dbconn, 'post_log', $_POST, PGSQL_DML_ESCAPE);
    if (    $res) {
    echo     "POST data is successfully logged\n";
    } else {
    echo     "User must have sent wrong inputs\n";
    }
    ?>

    See Also

    • pg_convert() - Convert associative array values into forms suitable for SQL statements

    Found A Problem?

    Learn How To Improve This Page • Submit a Pull Request • Report a Bug
    ＋add a note

    User Contributed Notes 9 notes

    up
    7
    shane at treesandthings dot com
    20 years ago
    Returns SQL statement, slight improvement on the code from 'rorezende at hotmail dot com'. This version adds bool values correctly.It also checks to make sure there is actually a value in the array before including it in the sql statement. (ie: null values or empty strings won't be added to the sql statement)

    <?PHP
    function db_build_insert($table,$array)
    {

    $str = "insert into $table ";
    $strn = "(";
    $strv = " VALUES (";
    while(list(    $name,$value) = each($array)) {

    if(    is_bool($value)) {
    $strn .= "$name,";
    $strv .= ($value ? "true":"false") . ",";
    continue;
    };

    if(    is_string($value)) {
    $strn .= "$name,";
    $strv .= "'$value',";
    continue;
    }
    if (!    is_null($value) and ($value != "")) {
    $strn .= "$name,";
    $strv .= "$value,";
    continue;
    }
    }
    $strn[strlen($strn)-1] = ')';
    $strv[strlen($strv)-1] = ')';
    $str .= $strn . $strv;
    return     $str;

    }
    ?>
    up
    1
    skippy at zuavra dot net
    19 years ago
    Beware of the following: pg_insert() and pg_update() are adding slashes to all character-like fields they work with. This makes them SQL injection super-safe, but there are unwanted consequences, as follows:

    If you have a regular setup with magic_quotes_gcp=On, and you use pg_insert() or pg_update(), you will end up with fields that look as if you used addslashes() twice. To solve this, you can use stripslashes() on the data just before using it with pg_insert() or pg_update().

    There's another alternative, which seems better to me. Why make yourself crazy all over the code, adding slashes, stripping slashes, worrying whether magic_quotes_gpc is on or off and so on and so forth? Why do this, when the only place you actually need those slashes is right when you push the data into the database?

    So why not get rid of your addslashes() and stripslashes() from all over your code, and turn magic_quotes_gcp off. As long as you always use pg_insert() and pg_update() to do your DB work, you're SQL-injection safe AND slash-headache free.
    up
    1
    jsnell at e-normous dot com
    17 years ago
    If you need schema support, this function will do something similar to pg_insert:

    function pg_insert_with_schema($connection, $table, $updates)
    {
    $schema = 'public';
    if (strpos($table, '.') !== false)
    list($schema, $table) = explode('.', $table);

    if (count($updates) == 0) {
    $sql = "INSERT INTO $schema.\"$table\" DEFAULT VALUES";
    return pg_query($sql);
    } else {
    $sql = "INSERT INTO $schema.\"$table\" ";

    $sql .= '("';
    $sql .= join('", "', array_keys($updates));
    $sql .= '")';

    $sql .= ' values (';
    for($i = 0; $i < count($updates); $i++)
    $sql .= ($i != 0? ', ':'').'$'.($i+1);
    $sql .= ')';
    return pg_query_params($connection, $sql, array_values($updates));
    }
    }
    up
    1
    phpuser at ego dot gen dot nz
    12 years ago
    This function cannot be used to insert a record with only default values - i.e. with an assoc_array of array()
    up
    1
    Anonymous
    3 years ago
    $Result = pg_query_params($db,'INSERT INTO table1 (a, b, c) VALUES ($1,$2,$3) RETURNING *', array('1','2','3');
    $Row = pg_fetch_assoc($Result);
    pg_insert($db, 'table2', $Row);

    pg_insert fail silently if one or more fields on table2 have different names than on table1
    up
    0
    mina86 at tlen dot pl
    20 years ago
    Next version :) My version checks whether value is bool, null, string or numeric and if one of the values is not function returns false if not. null values are inserted as NULL, bool as true or false and strings are add-shlashed before adding to query string. Note, that this function is not safe. SQL injection is possible with column names if you use $_POST or something similar as a $array.

    <?php
    function db_build_insert($table, $array) {
    if (    count($array)===0) return false;
    $columns = array_keys($array);
    $values = array_values($array);
    unset(    $array);

    for (    $i = 0, $c = count($values); $i$c; ++$i) {
    if (    is_bool($values[$i])) {
    $values[$i] = $values[$i]?'true':'false';
    } elseif (    is_null($values[$i])) {
    $values[$i] = 'NULL';
    } elseif (    is_string($values[$i])) {
    $values[$i] = "'" . addslashes($values[$i]) . "'";
    } elseif (!    is_numeric($values[$i])) {
    return     false;
    }
    }

    return     "INSERT INTO $table ($column_quote" . implode(', ', $columns) .
    ") VALUES (" . implode(', ', $values) . ")";
    }
    ?>
    up
    -1
    excalibur at nospam dot icehouse dot net
    18 years ago
    Today at work I isolated a problem I was having with this function to how I was formatting the date. I was assigning the date in my code as follows:

    $today = date( "Ymd" ); // ISO 8601

    This format is acceptable to PostgreSQL, as verified by their documentation and buy tests using psql. However, to make it work in my code, I had to make the following change:

    $today = date( "Y-m-d" ); // also ISO 8601 format
    up
    -3
    rorezende at hotmail dot com
    21 years ago
    Time is money, then I write a function similar to pg_insert in PHP (only output sql statement) :

    function db_mount_insert($table,$array) {

    $str = "insert into $table (";
    while(list($name,$value) = each($array)) {
    $str .= "$name,";
    }
    $str[strlen($str)-1] = ')';
    $str .= " values (";
    reset($array);
    while(list($name,$value) = each($array)) {
    if(is_string($value))
    $str .= "'$value',";
    else
    $str .= "$value,";
    }
    $str[strlen($str)-1] = ')';
    $str .= ";" ;

    return $str;

    }
    up
    -4
    ANDYCHR17 at HOTMAIL dot COM
    18 years ago
    Had a few issues while trying to run this in PHP 4.4.0:

    - I could not get it to work with column names that are SQL reserved words (example: desc, order). I was forced to change the column names in order to use the function. I could not put the column names in quotes, because that caused pg_convert() to fail.

    - Function was returning false until I passed the PGSQL_DML_EXEC option.
    ＋add a note
    To Top