Inserted value in database is 0 even tho it should not be

Question

I know its something stupid that im missing here, but everytime else is executed in below code, 0 is added to my column grupa_id (its under comment #prikaz plana) when it should in fact select the max id from my other table called grupa. When 'If' occures everything is fine, the correct data is inserted in database, even in Else correct data is inserted when i put '(select MAX(id) FROM grupa)' instead of variable $dataId. Can anyone see what am i missing here?

$dataId;
            $Data = $ks->getQuery("SELECT id, naziv from grupa WHERE naziv='$postNazivGrupe'");
            if($Data->num_rows>0)
            {
                while($Row = $Data->fetch_assoc())
                {
                    $dataId = $Row['id'];               
                }
            }
            else
            {

                $Data = $ks->getQuery("INSERT into grupa(oznaka_grupe, naziv, nadgrupa) VALUES ('$postOznaka_grupe', '$postNazivGrupe', '$postNazivNadgrupe')");
                $dataId ="(select MAX(id) FROM grupa)";
            }


            ##upis plana
            $Data = $ks->getQuery("UPDATE plan SET grupa_id='$dataId' WHERE id=$postID");

You are vulnerable to SQL injection http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php — Dallin, Dec 30 '14 at 13:33
Its int column. @Dallin thanks for posting man im aware of that, this is just localhost project so i didnt bother too much to protect it. — Chilipepper, Dec 30 '14 at 13:35

Hanky Panky · Accepted Answer · 2014-12-30T15:21:38.443

1

In your else case you are generating an invalid dataId

$dataId ="(select MAX(id) FROM grupa)";

That is not a valid dataId, the result of that query will be. The previous answer was correct, don't know why it was deleted.

This makes your query to become this

"UPDATE plan SET grupa_id='(select MAX(id) FROM grupa)' WHERE id=$postID"

If that is how you intend it to be, remove the single quotes around that variable then. With your single quotes does not execute that subquery and tries to put that whole query as the value but since the field is numeric it gets converted to 0. Remove the single quotes around $dataId in your update query.

This version is fine

"UPDATE plan SET grupa_id=(select MAX(id) FROM grupa) WHERE id=$postID"

edited Dec 30 '14 at 15:21

answered Dec 30 '14 at 13:41

Hanky Panky

46,730
8
72
95

Yes, that is how i intended it to be, removing quotes worked perfectly. Thanks! – Chilipepper Dec 30 '14 at 13:50
Because OP sad: `So in case 'else' occurs grupa_id should be this: (select MAX(id) FROM grupa)` And I thought, he want to insert this string, not the result of the query. – vaso123 Dec 30 '14 at 15:23

Inserted value in database is 0 even tho it should not be

1 Answers1