1

I have a database which I am using to collect test data.

It shows each record on a new line with an edit and delete link at the end and also an add new record link.

Everything is working apart from the edit section. I can't see where I'm going wrong?

When I click the edit link, it shows me the layout of the table with the fields etc, but it is only passing across the row ID, and showing it in the date field. If i type into the fields and submit, it will change. It just won't pass over the data.

Here is my edit page, and the edit script.

   <?php
function valid($date,$error)
{
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<title>Edit Records</title>
</head>
<body>
<?php

if ($error != '')
{
echo '<div style="padding:4px; border:1px solid red; color:red;">'.$error.'</div>';
}
?>

<form action="" method="post">
<input type="hidden" name="id" value="<?php echo $date; ?>"/>

<table border="1">
<tr>
<td colspan="2"><b><font color='Red'>Edit Records </font></b></td>
</tr>

<tr>
<td width="179"><b><font color='#663300'>Date</font></b></td>
<td><label>
<input type="text" name="date" value="<?php echo $date; ?>" />
</label></td>
</tr>

<tr>
<td width="179"><b><font color='#663300'>Ammonia</em></font></b></td>
<td><label>
<input type="text" name="amm" value="<?php echo $amm; ?>" />
</label></td>
</tr>

<tr>
<td width="179"><b><font color='#663300'>Nitrate</font></b></td>
<td><label>
<input type="text" name="nat" value="<?php echo $nat; ?>" />
</label></td>
</tr>

<tr>
<td width="179"><b><font color='#663300'>Nitrite</font></b></td>
<td><label>
<input type="text" name="nit" value="<?php echo $nit; ?>" />
</label></td>
</tr>

<tr>
<td width="179"><b><font color='#663300'>pH</font></b></td>
<td><label>
<input type="text" name="ph" value="<?php echo $ph; ?>" />
</label></td>
</tr>

<tr>
<td width="179"><b><font color='#663300'>Alkalinity</font></b></td>
<td><label>
<input type="text" name="alk" value="<?php echo $alk; ?>" />
</label></td>
</tr>

<tr>
<td width="179"><b><font color='#663300'>SG</font></b></td>
<td><label>
<input type="text" name="sg" value="<?php echo $sg; ?>" />
</label></td>
</tr>

<tr>
<td width="179"><b><font color='#663300'>Temperature</font></b></td>
<td><label>
<input type="text" name="temp" value="<?php echo $temp; ?>" />
</label></td>
</tr>

<tr align="Right">
<td colspan="2"><label>
<input type="submit" name="submit" value="Edit Records">
</label></td>
</tr>
</table>
</form>
</body>
</html>
<?php
}

include('config.php');

if (isset($_POST['submit']))
{

if (is_numeric($_POST['id']))
{

$id = $_POST['id'];
$date = mysql_real_escape_string(htmlspecialchars($_POST['date']));
$amm = mysql_real_escape_string(htmlspecialchars($_POST['amm']));
$nat = mysql_real_escape_string(htmlspecialchars($_POST['nat']));
$nit = mysql_real_escape_string(htmlspecialchars($_POST['nit']));
$ph = mysql_real_escape_string(htmlspecialchars($_POST['ph']));
$alk = mysql_real_escape_string(htmlspecialchars($_POST['alk']));
$sg = mysql_real_escape_string(htmlspecialchars($_POST['sg']));
$temp = mysql_real_escape_string(htmlspecialchars($_POST['temp']));


if ($date == '')
{

$error = 'ERROR: Please fill in all required fields!';


valid($date, $error);
}
else
{

mysql_query("UPDATE employee SET date='$date', amm='$amm', nat='$nat', nit='$nit', ph='$ph', alk='$alk', sg='$sg', temp='$temp'")
or die(mysql_error());

header("Location: view.php");
}
}
else
{

echo 'Error!';
}
}
else

{

if (isset($_GET['id']) && is_numeric($_GET['id']) && $_GET['id'] > 0)
{

$id = $_GET['id'];
$result = mysql_query("SELECT * FROM employee WHERE id=$id")
or die(mysql_error());
$row = mysql_fetch_array($result);

if($row)
{

$date = $row['date'];
$amm = $row['amm'];
$nat = $row['nat'];
$nit = $row['nit'];
$ph = $row['ph'];
$alk = $row['alk'];
$sg = $row['sg'];
$temp = $row['temp'];

valid($id,'');
}
else
{
echo "No results!";
}
}
else

{
echo 'Error!';
}
}
?>
Cœur
  • 37,241
  • 25
  • 195
  • 267
  • 1
    You really maintain the code with 0 formatting involved? – N.B. Feb 18 '14 at 15:19
  • 1
    `$id = $_GET['id']; $result = mysql_query("SELECT * FROM employee WHERE id=$id")` its vulnerable to sql injection – NullPoiиteя Feb 18 '14 at 15:24
  • Possible duplicate of [How to get useful error messages in PHP?](https://stackoverflow.com/questions/845021/how-to-get-useful-error-messages-in-php) – Progman May 21 '18 at 09:52

2 Answers2

1

The function valid is responsible for rendering your form. But you only pass the $date into this function, so this is the only thing it can fill in. You have to pass the other values, too!

Lars Ebert
  • 3,487
  • 2
  • 24
  • 46
-1

check this:

UPDATE employee SET date='$date', amm='$amm', nat='$nat', nit='$nit', ph='$ph', alk='$alk', sg='$sg', temp='$temp' WHERE id='$id'
Pablo R
  • 19
  • 2