My database isn't getting updated after submission

Question

When opening this page, multiple forms must be displayed. each form is for a specific employee, the user decides which employee he wants to assign to time slot, slecets times, clicks on submit, then the database gets updated with the new values and forms get displayed again, everything is working except that the db isn't getting updated. here is the part of my code i thought you'd need to see:

<?php
ini_set('display_errors',1); 
 error_reporting(E_ALL);
// Start database connection
include ('connection.php');
session_start();
// Write QUERY                  
                    if ( isSet($_POST['Time_in'], $_POST['Time_out'], $_POST['Spec_ID']  ) ) {
                    $qry="UPDATE 'Specialist' SET 'Time_in' = '".$_POST['Time_in']."' ,  Time_out = '".$_POST['Time_out']."'  WHERE Spec_ID ='".$_POST['Spec_ID']."';";
                    $result = mysql_query ($qry);
                        $qry = 'SELECT * FROM Specialist' ;
                    }
                else

                        $qry = 'SELECT * FROM Specialist' ;
                    //Run QUERY
                    $result = mysql_query ($qry);       
?>


<!DOCTYPE html>
<html lang="en">

<head>

    <meta charset="utf-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <meta name="description" content="">
    <meta name="author" content="">

    <title>Assign to time slot</title>

</head>

<body scroll="no" style="overflow: hidden">

<div class="wrapper">

    <div class="logo"><a href="adminpage.html"><img src="logo.png"  alt="logo" height="162px"width="800px"  style="border-style:none" title="Home"/></a></div>



                    <?php


if($result) {
$did = 0;
Print " <table style='width:100%'>";

while($info=mysql_fetch_array($result))
{
if($did==0){
Print "<form  method='POST' enctype='multipart/form-data' style='display:inline;' >

<tr>
     <td><figure style='text-align:centre;'>
  <img STYLE='border: thin solid grey;left:00px;top:00px;'src='img/idimg.jpg' alt='idimage' width='110' height='110'>
  <figcaption>".$info['Spec_Name']."<br/>".$info['Spec_ID']."<br/>".$info['Specialty']. "</br>  

  From: <select name='Time_in'>
  <option disabled selected> unspecified </option>
  <option value='08:00'>08:00AM</option>
  <option  value='09:00'>09:00AM</option>
  <option  value='10:00'>10:00AM</option>
  <option  value='11:00'>11:00AM</option>
  <option  value='12:00'>12:00AM</option>
    <option value='02:00'>02:00PM</option>
  <option value='04:00'>04:00PM</option>
  <option  value='05:00'>05:00PM</option>
</select>


 TO: <select name='Time_out'>
    <option disabled selected> unspecified </option>
  <option value='08:00'>08:00PM</option>
  <option value='09:00'>09:00PM</option>
  <option value='10:00'>10:00PM</option>
  <option value='11:00'>11:00PM</option>
  <option value='12:00'>12:00PM</option>
    <option value='02:00'>02:00PM</option>
  <option value='04:00'>04:00PM</option>
  <option value='05:00'>05:00PM</option>
</select>

<input type='hidden' name='Spec_ID' value='".$info['Spec_ID']."' />
<input name='Submit' type='submit' value='Assign' /> 
  </br></br></br></figcaption>
</figure></td> </form>";

$did++;
continue; }



if($did==1){

Print "<form  method='POST' enctype='multipart/form-data' style='display:inline;'  >


     <td><figure style='text-align:centre;'>
  <img STYLE='border: thin solid grey;left:00px;top:00px;'src='img/idimg.jpg' alt='idimage' width='110' height='110'>
  <figcaption>".$info['Spec_Name']."<br/>".$info['Spec_ID']."<br/>".$info['Specialty']. "</br>  

  From: <select name='Time_in'>
    <option disabled selected> unspecified </option>
  <option value='08:00'>08:00AM</option>
  <option value='09:00'>09:00AM</option>
  <option value='10:00'>10:00AM</option>
  <option value='11:00'>11:00AM</option>
  <option value='12:00'>12:00AM</option>
    <option value='02:00'>02:00PM</option>
  <option value='04:00'>04:00PM</option>
  <option value='05:00'>05:00PM</option>
</select>


 TO: <select name='Time_out'>
  <option disabled selected> unspecified </option>
  <option value='08:00'>08:00PM</option>
  <option value='09:00'>09:00PM</option>
  <option value='10:00'>10:00PM</option>
  <option value='11:00'>11:00PM</option>
  <option value='12:00'>12:00PM</option>
  <option value='02:00'>02:00PM</option>
  <option value='04:00'>04:00PM</option>
  <option value='05:00'>05:00PM</option>
</select>

<input type='hidden' name='Spec_ID' value='".$info['Spec_ID']."' />
<input name='Submit' type='submit' value='Assign' /> </br></br></br></figcaption>
</figure></td></tr> </form>";
$did--;

}
}
Print " </table>";

}

else echo "There are no specialists";

    ?>



</div>
    <!-- /.container -->

</div>
</body>
</html>


<?php 
// close database connection
MYSQL_CLOSE ($con);
?>

When i tried this query in phpmyadmin to update the values it worked! but not in my code

You are using single quotes around the table and column names (instead of backticks, but you don't need quotes at all). I consider this a typographical error and vote to close such questions. — Gordon Linoff, Nov 22 '14 at 15:26

score 1 · Accepted Answer · edited May 23 '17 at 12:22

1

UPDATE 'Specialist' SET 'Time_in'
       ^          ^

Table names are not to be placed inside quotation marks. That is the primary reason your query fails. You aren't checking the result of your query execution either.

Also: How can I prevent SQL injection in PHP?

edited May 23 '17 at 12:22

Community

1
1

answered Nov 22 '14 at 15:27

Hanky Panky

46,730
8
72
95

where is the question mark you mentioned? could you please explain – user3419062 Nov 22 '14 at 15:28
Quotation marks, not question marks. I just updated the answer to mention which ones. – Hanky Panky Nov 22 '14 at 15:30
do i have to use pdo? i really don't understand what pdo is – user3419062 Nov 22 '14 at 15:31
1

You can use mysqli_* then, its very similar to mysql_*. Yes i think you should spend a couple of hours to learn those instead of learning to use an insecure api thats already deprecated. However the solution that i have mentioned does not force you to use those. It will still work with your current mysql_query call as long as there are no other errors in the query. – Hanky Panky Nov 22 '14 at 15:33
@user3419062: yes you do. What you have is dangerous. You can do a Google search to find out all sorts of information on PDO. It's not that hard and it'll be good for you in the long run. – siride Nov 22 '14 at 15:33
do you mean that i should say UPDATE Specialist SET Time_in without using any quotation mark? – user3419062 Nov 22 '14 at 15:33
Yes i do mean that. If you really want to use something there then use backticks like this ` – Hanky Panky Nov 22 '14 at 15:34
it's working after removing quotation marks, thank you very much – user3419062 Nov 22 '14 at 15:48

My database isn't getting updated after submission

1 Answers1