How to solve cannot use string offset as an array error in PHP?

Question

I want to add multiple data into table at once but my code gives an error saying 'cannot use string offset as an array'. I have attached my code. Can anyone help me to solve this?

$issuedate=$_POST['issuedate'];
$member=$_POST['member'];
$bno[0]['TitleNo'] = $_POST['bno'];
$bno[1]['TitleNo'] = $_POST['bno1'];
$bno[2]['TitleNo'] = $_POST['bno2'];
$bno[3]['TitleNo'] = $_POST['bno4'];                        
$returndate = $_POST['returndate'];

for($i=0; $i<4; $i++)
{
    $sql5 = mysqli_query($db, "INSERT INTO borrow(TitleNo,MemberID,IssueDate,dueDate,ReturnDate) VALUES ('".$bno[$i]['TitleNo']."','$member','$issuedate','$returndate')");
}

if ($sql5)
{
    echo '<h4 class="message">Add New Book Copies! </h4>'; // echo $test;   
}
else
{
    echo 'Fail.';
}

You could make your life easier using arrays for the name attributes of your inputs as well. And you have an sql injection problem. — jeroen, Apr 22 '15 at 08:27
looks like `$bno` had the string assigned to it instead of array before this code. — n-dru, Apr 22 '15 at 08:39
For start ... start watching videos (like Laracast) and reading tutorials for clear and reusable code! On other hand ... just add "$bno = array();" — Lachezar Todorov, Apr 22 '15 at 09:32

score 2 · Answer 1 · edited May 23 '17 at 11:43

You are probably assigning string to $bno variable thus it dynamically becomes of type string. More info here. Regarding the example you should

$bno = array();
Escape all your DB inputs (or even better, use prepared statements)
It makes more sense to put the if..else inside the for loop

Thus

$bno = array();

$mysqli_conn = mysqli_connect("localhost", "user", "password", "schema");

$issuedate = mysqli_real_escape_string($mysqli_conn, $_POST['issuedate']);
$member = mysqli_real_escape_string($mysqli_conn, $_POST['member']);
$bno[0]['TitleNo'] = mysqli_real_escape_string($mysqli_conn, $_POST['bno']);
$bno[1]['TitleNo'] = mysqli_real_escape_string($mysqli_conn, $_POST['bno1']);
$bno[2]['TitleNo'] = mysqli_real_escape_string($mysqli_conn, $_POST['bno2']);
$bno[3]['TitleNo'] = mysqli_real_escape_string($mysqli_conn, $_POST['bno4']);                        
$returndate = mysqli_real_escape_string($mysqli_conn, $_POST['returndate']);

for($i=0; $i<4; $i++)
{
    $sql = mysqli_query($db, "INSERT INTO borrow(TitleNo,MemberID,IssueDate,dueDate,ReturnDate) VALUES ('".$bno[$i]['TitleNo']."','".$member."','".$issuedate."','".$returndate."')");

    if ($sql)
    {
        echo '<h4 class="message">Add New Book Copies! </h4>'; // echo $test;   
    }
    else
    {
        echo 'Fail.';
    }
}

You have an error in your code. When using mysqli_real_escape_string in procedural style you should pass the DB instance. — iivannov, Apr 22 '15 at 09:35
mysqli_real_escape_string is used wrong! Please check documentation and fix your code. — Lachezar Todorov, Apr 22 '15 at 09:35
Sorry, was typing at the speed of thoughts. Edited the answer. — sitilge, Apr 22 '15 at 09:40

iivannov · Accepted Answer · 2015-04-22T09:38:23.427

You have set $bno as string in some previous code. What you can do for a quick fix is:

change $bno to somehing else, for example $book

$book[0]['TitleNo'] = $_POST['bno'];  
$book[1]['TitleNo'] = $_POST['bno1'];
//..

set $bno to a new array and then assign the values

$bno = array();
$bno[0]['TitleNo'] = $_POST['bno'];  
$bno[1]['TitleNo'] = $_POST['bno1'];  
//...

Additional Notes

By the way it's better to escape somehow the values you enter in your DB. You can use mysqli_real_escape_string

Just assign do this for all the values:

$bno[0]['TitleNo'] = mysqli_real_escape_string($db, $_POST['bno']);

Sources to read

http://php.net/manual/en/mysqli.real-escape-string.php

score 0 · Answer 3 · answered Apr 22 '15 at 09:19

You should have a look att prepared statements and bind params. When you're doing the insert statements you select five columns and only inserts four values.

 $sql5 = mysqli_query($db, "INSERT INTO borrow(TitleNo,MemberID,IssueDate,dueDate,ReturnDate) VALUES ('".$bno[$i]['TitleNo']."','$member','$issuedate','$returndate')");

And as @jeroen mentioned, your code has sql-injection problems, read more about sql-injection here.

I've created and exampel using prepared statements and bind params. Note:

$stmt->bind_param('sssss',$bno[$i]['TitleNo'], $member, $issuedate, $dueDate, $returndate);

'sssss' are just for demo purpose, I assume dueDate and returndate columns are datetime something simular.

$DBServer = 'localhost';
$DBUser  = 'root';
$DBPass = 'root';
$DBName = 'borrow';

$conn = new mysqli($DBServer, $DBUser, $DBPass, $DBName);

$sql = ' INSERT INTO borrow (TitleNo,MemberID,IssueDate,dueDate,ReturnDate) VALUES (?,?,?,?,?)';

$TitleNo = $bno[0]['TitleNo'];
$member = 'MemberID';
$issuedate = 'issuedate';
$dueDate = 'dueDate';
$returndate = 'returndate';

/* Prepare statement */
$stmt = $conn->prepare($sql);
if($stmt === false) {
trigger_error('Wrong SQL: ' . $sql . ' Error: ' . $conn->error, E_USER_ERROR);
}


for( $i= 0; $i < count($bno); $i++){
/* Bind parameters. s = string, i = integer, d = double,  b = blob */
$stmt->bind_param('sssss',$bno[$i]['TitleNo'], $member, $issuedate, $dueDate, $returndate);

/* Execute statement */
$stmt->execute();
}
if( $stmt->affected_rows > 0 ){
    echo '<h4 class="message">Add New Book Copies!</h4>';
}

$stmt->close();

However im not sure if it's best practice to do a mass insert to db using a for-loop.

score 0 · Answer 4 · answered Apr 22 '15 at 09:23

Initialising your array (ie, $bno was probably initialised to a string in your code which caused the error you are seeing), escaping the input and doing a single INSERT (rather than 4, where you only check the results of the last one):-

<?php 
$bno = array();
$sql_array = array();
$issuedate = mysqli_real_escape_string($db, $_POST['issuedate']);
$member = mysqli_real_escape_string($db, $_POST['member']);
$bno[0]['TitleNo'] = mysqli_real_escape_string($db, $_POST['bno']);
$bno[1]['TitleNo'] = mysqli_real_escape_string($db, $_POST['bno1']);
$bno[2]['TitleNo'] = mysqli_real_escape_string($db, $_POST['bno2']);
$bno[3]['TitleNo'] = mysqli_real_escape_string($db, $_POST['bno4']);                        
$returndate = mysqli_real_escape_string($db, $_POST['returndate']);

foreach($bno AS $abno)
{
    $sql_array = "('".$bno['TitleNo']."','$member','$issuedate','$returndate')"
}
$sql5 = mysqli_query($db, "INSERT INTO borrow(TitleNo,MemberID,IssueDate,dueDate,ReturnDate)
        VALUES ".implode(', ', $sql_array));            
if ($sql5) 
{
    echo '<h4 class="message">Add New Book Copies!</h4>';
    // echo $test;
} 
else
{
    echo 'Fail.';
}

This does suggest that the database could be further normalised, as you have multiple rows being inserted that are identical except for one value.

How to solve cannot use string offset as an array error in PHP?

4 Answers4