Undefined index in line 14 of php code

Question

Possible Duplicate:
PHP: “Notice: Undefined variable” and “Notice: Undefined index”

I know its basic but I've been up for 8 hours coding and this has gotten me stuck. Receiving an undefined index for all my posts on line 14 for my update query. I would appreciate any help in the matter thanks.

<html>
<head>  
</head>
<body>
<h1><center><i>Edit/Add Course ID</i></center></h1>
<?php 
$con = mysql_connect("localhost","u/n","p/w");
if (!$con){
die ("Can not connect: " . mysql_error());
}
mysql_select_db("my_db",$con);

if(isset($_POST['submit'])){
$UpdateQuery = "UPDATE course SET cours_num='$_POST[coursnum]', 
cours_title='$_POST[courstitle]', cours_desc='$_POST[coursdesc]' WHERE 
cours_num='$_POST[hidden]'";
mysql_query($UpdateQuery, $con);

};
$sql = "Select * FROM course";
$myData = mysql_query($sql,$con);

while($record = mysql_fetch_array($myData)){
echo "<form action=mydata.php method=post>";
echo "<b>Course Number:</b></br>";
echo "<input type=text maxlength=10 size=10 readonly name=coursnum value=" . 
$record['cours_num'].">";
echo "</br></br>";
echo "<b>Course Title:</b><br/>";
echo "<input type=text maxlength=10 size=10 name=courstitle value=" . 
$record['cours_title'].">";
echo "</br></br>";
echo "<b>Course Description:</b></br>";
echo "<input type=text name=coursdesc max length=50 size=50 value=" . 
$record['cours_desc'].">";
echo "</br></br>";
echo "<input type=hidden name=hidden value=" . $record['cours_num'].">";
echo "<center><input type=submit name=submit value=Edit></center>";
echo "</form>";
}

mysql_close($con);

?>
</body>
</html>

Hey, what you're doing is terribly insecure. You are **wide open** to SQL injection, and you **will be hacked** if you haven't been already. Learn to use prepared queries with PDO to avoid this problem entirely. Also, your actual problem is that you've got your array indices messed up or missing. — Brad, Oct 13 '12 at 18:28
At a _minimum_, you _MUST_ call `mysql_real_escape_string()` on each of those `$_POST` keys used in the query. — Michael Berkowski, Oct 13 '12 at 18:29
[Don't use the obsolete `mysql_*` functions](http://stackoverflow.com/q/12859942/19068) — Quentin, Oct 13 '12 at 18:29
[Don't open yourself up to SQL Injection attacks like that](http://bobby-tables.com/) — Quentin, Oct 13 '12 at 18:29
obviously one of your `$_POST` variables doesn't exist. Exactly what notice said — Alexander Larikov, Oct 13 '12 at 18:30
Instead of `$_POST[coursnum]`, use `$_POST['coursnum']` (with quotes) and correct it on all your vars. — Alain Tiemblo, Oct 13 '12 at 18:38
@Ninsuo Inside a double-quoted string, when not enclosing in `{}` omitting the quotes around array keys is actually valid and won't issue E_NOTICE. — Michael Berkowski, Oct 13 '12 at 18:39
Thank you @MichaelBerkowski, I didn't knew that. Everyday I learn new PHP things on SO, love it! :-) It looks like even if it is enclosed in `{}`, it also works without warnings. — Alain Tiemblo, Oct 13 '12 at 18:41
Welcome to Stack Overflow! Please, don't use `mysql_*` functions to write new code. They are no longer maintained and the community has begun [deprecation process](http://goo.gl/KJveJ). See the *[red box](http://goo.gl/GPmFd)*? Instead you should learn about [prepared statements](http://goo.gl/vn8zQ) and use either [PDO](http://php.net/pdo) or [MySQLi](http://php.net/mysqli). If you can't decide which, [this article](http://goo.gl/3gqF9) will help you. If you pick PDO, [here is good tutorial](http://goo.gl/vFWnC). Also see [Why shouldn't I use `mysql` functions in PHP?](http://goo.gl/ycnmO) — Madara's Ghost, Oct 13 '12 at 20:47

score 0 · Accepted Answer · answered Oct 13 '12 at 18:32

You are getting error due to the following line

$UpdateQuery = "UPDATE course SET cours_num='$_POST[coursnum]', 
cours_title='$_POST[courstitle]', cours_desc='$_POST[coursdesc]' WHERE 
cours_num='$_POST[hidden]'";

You can use

$UpdateQuery = sprintf("UPDATE course SET cours_num='%d' , 
                cours_title='%s', 
                cours_desc='%s',
                WHERE  cours_num = '%d'", mysql_real_escape_string($_POST['coursnum']), mysql_real_escape_string($_POST['courstitle']), mysql_real_escape_string($_POST['coursdesc']), mysql_real_escape_string($_POST['hidden']));

You should also make sure your variables are always set

Example

$_POST['coursnum'] = isset($_POST['coursnum']) ? $_POST['coursnum'] : null ;

your code does not solve the unknown index warnings. it simply removes the sql injection vulnerability. you're still trying to use $_POST values that (possibly) don't exist. — Marc B, Oct 13 '12 at 19:18
@MarB .. you should look at the second example showing the user how to use `isset` — Baba, Oct 13 '12 at 19:25

Undefined index in line 14 of php code

1 Answers1