sql update statement from a html form doesn't execute

Question

<?php

//include 'includes/connectie.php';
if (isset($_GET['id'])){
$product_id=$_GET['id'];
       } else {
$product_id=$_POST['id'];
       }


$user = 'userID';
$pass = 'mypassword';
$dbh = new PDO( 'mysql:host=localhost;dbname=webshop', $user, $pass );


    $sql = "SELECT * FROM  `producten` WHERE product_id='$product_id'";
    $sql_result = $dbh->query($sql);

    foreach($sql_result as $row)
        {   
            $prijs=$row['prijs'];
            $product_naam=$row['product_naam'];
            $product_categorie=$row['product_categorie'];
            $product_specificaties=$row['product_specificaties'];
            $foto=$row['foto'];
            $product_id=$row['product_id']; 
            $product_soort=$row['product_soort'];


            echo "Product id nummer:", $product_id;

        }

//$_SESSION['prijs'] = $prijs;




if ($_SERVER["REQUEST_METHOD"] == "POST"){

//if (!empty($product_naam) && !empty($product_specifcaties) && !empty($product_categorie) && !empty($prijs)
//&& !empty($product_soort))
If (isset($_POST['submit'])) 
 {

    $sql = "UPDATE producten 
    SET prijs='$prijs', product_naam='$product_naam', product_specificaties='$product_specificaties',
    product_categorie='$product_categorie', product_soort='$product_soort',
    WHERE product_id='$product_id'";

    $query = $dbh->prepare( $sql );
    $result = $query->execute();
    if ($result){
        echo "Product aangepast!!!!! in id:";
        echo $product_id;
        } else {
        echo "Product NIET aangepast!!!!";
            }

  }



}


?>

<form name="admin" action="producten_echt_aanpassen.php" method="POST" enctype="multipart/form-data">

     <p>
         <label for 'product_id'>Product ID: </label><br>
             <input type="text" name="id" value="<?php print $product_id; ?>"/>
    </p>
    <p>
        <label for 'product_naam'>Naam: </label><br>
        <input type="text" name="product_naam" value="<?php print $product_naam; ?>"/>
    </p>
    <p>     <label for 'product_specificaties'>Specificaties: </label><br>
        <textarea rows= "4" cols="50" name="product_specificaties"><?php print $product_specificaties; ?>
        </textarea>
    </p>
    <p>
        <label for 'prijs'>Prijs: </label><br>
        <input type="text" name="prijs" value="<?php print $prijs; ?>"/>
    </p>
    <p>
        <label for 'product_categorie'>Iphone: </label><br>
        <input type="text" name="product_categorie" value="<?php print $product_categorie; ?>"/>
    </p>
    <p>
        <label for 'product_soort'>Soort: </label><br>
        <input type="text" name="product_soort" value="<?php print $product_soort; ?>"/>
    </p>
      <br/>
        <label for 'uploadfile'>Kies foto <img src="<?php print $foto; ?>"></label><br>
        <input type="file" name="file" ><br><br>


        <input type="submit" name="submit" value="Submit">

</form>

I have a form in which I load properties of products like the product name, price, photo etc. The properties are then possible to change and then updated in the database. But the sql update statement does not execute. Can anybody help me out?

You have a **comma** in your `update query` which should not be there (right before `WHERE` clause). Moreover, you should consider using **prepared statement** — Justin Iurman, Jan 26 '14 at 22:52
Well, you should use prepared statement. Don't ask me what you can use instead. This is what you already do. And it's bad practice. Good for sql injection for example — Justin Iurman, Jan 26 '14 at 23:07

score 0 · Answer 1 · answered Jul 24 '17 at 08:16

0

there is a , before the where on the update that should not be there. Try to activate error reporting like this: How to get useful error messages in PHP? so that you know wwhy things are failing

answered Jul 24 '17 at 08:16

caryarit ferrer

326
3
12

If we get a DB error we usually put it into a array and json_decode for debug purposes. Yes I know there are other ways. But I will enjoy reading your link.\ – jmr333 Jun 08 '22 at 16:08

sql update statement from a html form doesn't execute

1 Answers1