HTML form not updating mySQL through PHP file

Question

I'm not quite sure what's going on because I'm following the same concept of implementation on this page as several other pages on the site. For some reason, this page will not update the database. It throws no errors or anything, just doesn't update the user information.

The HTML shows a text box and radio buttons at the top so the admin user can type a name and select whether to promote, demote, activate, or deactivate the account entered into the text box. Once submitted, the code doesn't yell at me but instead does nothing. I've tried several different ways of doing this but no matter what it's not updating the database.

Here is the HTML file (shortened):

  <?php include_once ($_SERVER['DOCUMENT_ROOT'] . '/public_html/templates/areadmin.php');


    if(isset($_POST['user']))
    {
        checkfunc();
    }
    else
    {   
?>

<!-- Contents of the page-->
<div class="container2">
    <div align="center"><br/><br/>
        <div id="box1"><br/><br/><br/>
            <form action="?checkfunc" style="display:inline; margin:2px;" method="post">
                <input type="text" autocomplete="off" size="15" placeholder="Username" name="user"><br/>
                <input type="radio" name="act" value="promote">Promote
                <input type="radio" name="act" value="demote">Demote
                <input type="radio" name="act" value="activate">Activate
                <input type="radio" name="act" value="deactivate">Deactivate
                <br/><input type="submit" value="Submit">
            </form>


                <?php include_once ($_SERVER['DOCUMENT_ROOT'] . '/public_html/PHP/action.php'); listmembers($db_handle); ?>
            </table><br/><br/><br/><br/>
        </div>
    </div>
</div>

<?php
    }
    function checkfunc()
    {
        $selected = $_REQUEST['act'];

        if($selected == "promote")
        {
            promote($db_handle);
        }
        elseif($selected == "demote")
        {
            demote($db_handle);
        }
        elseif($selected == "activate")
        {
            activate($db_handle);
        }
        elseif($selected == "deactivate")
        {
            deactivate($db_handle);
        }
    }
?>

Functions from the PHP file:

$db_handle = mysqli_connect($server, $user_name, $pass_word, $database);

//Date: June 25, 2015
//Description: promotes a user to admin
function promote($db_handle)
{
        //Grabs info from HTML
        $user = $_POST['user'];

        //Updates user to admin
        mysqli_query($db_handle, "UPDATE `user` SET isAdmin = 1 WHERE username = '$user'");
        header ("Location: /public_html/HTML/memberlist.html");
}

//Date: June 25, 2015
//Description: demotes a user to standard
function demote($db_handle)
{
        //Grabs info from HTML
        $user = $_POST['user'];

        if($user != $_SESSION['username'] && $user != "admin")
        {
            //Updates user to admin
            mysqli_query($db_handle, "UPDATE `user` SET isAdmin = 0 WHERE username = '$user'");
            header ("Location: /public_html/HTML/memberlist.html");
        }
        else
        {
            echo "nope.";
        }
}

//Date: June 25, 2015
//Description: activates an inactive account
function activate($db_handle)
{
        //Grabs info from HTML
        $user = $_POST['user'];

        //Updates user to admin
        mysqli_query($db_handle, "UPDATE `user` SET isActive = 1 WHERE username = '$user'");
        header ("Location: /public_html/HTML/memberlist.html");
}

function deactivate($db_handle)
{
        //Grabs info from HTML
        $user = $_POST['user'];

        //Updates user to admin
        mysqli_query($db_handle, "UPDATE `user` SET isActive = 0 WHERE username = '$user'");
        header ("Location: /public_html/HTML/memberlist.html");
}

Can anyone tell me why the database won't take my update statements?

UPDATE:

With the error handling it is telling me that $db_handle is undefined and null from within the .php functions, however, there are over a dozen functions in the .php and all of them have $db_handle as a parameter and work. Even listmembers($db_handle) is used on this same .html and isn't giving errors.

You can likely look in your error logs and find out why. Or you can add error checking to your queries. — Jay Blanchard, Jul 08 '15 at 13:12
try using the query UPDATE `user` SET isAdmin = '1' WHERE username = '$user' — Santosh Jagtap, Jul 08 '15 at 13:14
try adding `or die(mysqli_error($db_handle))` after your query and see what error is thrown - http://php.net/manual/en/mysqli.error.php — Pete, Jul 08 '15 at 13:22
If `$user` contains a quote the query is invalid. You should use prepared statements. You should also as noted already check for errors. — chris85, Jul 08 '15 at 13:26
Note that it is **extremely dangerous** to add raw `$_POST` data to a database, as it makes you vulnerable to SQL Injection. Learn more here, and do not make this code live until you have fixed this: http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php — pattyd, Jul 08 '15 at 15:13

score 0 · Accepted Answer · answered Jul 08 '15 at 15:54

I solved the issue by creating a new function in the .php file to check the function that needs to be run and passing it the global variable $db_handle.

HTML:

<?php include_once ($_SERVER['DOCUMENT_ROOT'] . '/public_html/templates/areadmin.php');

if(isset($_POST['user']))
{
    checkfunc();
}
else
{   
?>

<!-- Contents of the page-->
<div class="container2"> 
<div align="center"><br/><br/>
    <div id="box1"><br/><br/><br/>
        <form action="?checkfunc" style="display:inline; margin:2px;" method="post">
            <input type="text" autocomplete="off" size="15" placeholder="Username" name="user"><br/>
            <input type="radio" name="act" value="promote">Promote
            <input type="radio" name="act" value="demote">Demote
            <input type="radio" name="act" value="activate">Activate
            <input type="radio" name="act" value="deactivate">Deactivate
            <br/><input type="submit" value="Submit">
        </form>
    </div>
</div>
</div>
<?php
}
function checkfunc()
{
    include_once ($_SERVER['DOCUMENT_ROOT'] . '/public_html/PHP/action.php');
    checkfunction($db_handle);
}
?>

PHP:

//Author: Lance Rainey
//Date: June 25, 2015
//Description: promotes a user to admin
function checkfunction()
{
        global $db_handle;

        $selected = $_REQUEST['act'];

        if($selected == "promote")
        {
            promote($db_handle);
        }
        elseif($selected == "demote")
        {
            demote($db_handle);
        }
        elseif($selected == "activate")
        {
            activate($db_handle);
        }
        elseif($selected == "deactivate")
        {
            deactivate($db_handle);
        }
}

    //Author: Lance Rainey
//Date: June 25, 2015
//Description: promotes a user to admin
function promote($db_handle)
{
        //Grabs info from HTML
        $user = $_POST['user'];
        $query = "UPDATE `user` SET isAdmin = 1 WHERE username = '$user'";
        //Updates user to admin
        mysqli_query($db_handle, $query) or die(mysqli_error($db_handle));
        header ("Location: /public_html/HTML/memberlist.html");
}

    //Author: Lance Rainey
//Date: June 25, 2015
//Description: demotes a user to standard
function demote($db_handle)
{
        //Grabs info from HTML
        $user = $_POST['user'];
        $query = "UPDATE `user` SET isAdmin = 0 WHERE username = '$user'";

        if($user != $_SESSION['username'] && $user != "admin")
        {
            //Updates user to admin
            mysqli_query($db_handle, $query) or die(mysqli_error($db_handle));
            header ("Location: /public_html/HTML/memberlist.html");
        }
        else
        {
            echo "nope.";
        }
}

    //Author: Lance Rainey
//Date: June 25, 2015
//Description: activates an inactive account
function activate($db_handle)
{
        //Grabs info from HTML
        $user = $_POST['user'];
        $query = "UPDATE `user` SET isActive = 1 WHERE username = '$user'";

        //Updates user to admin
        mysqli_query($db_handle, $query) or die(mysqli_error($db_handle));
        header ("Location: /public_html/HTML/memberlist.html");
}

    //Author: Lance Rainey
//Date: June 25, 2015
//Description: deactivates an active account
function deactivate($db_handle)
{
        //Grabs info from HTML
        $user = $_POST['user'];
        $query = "UPDATE `user` SET isActive = 0 WHERE username = '$user'";

        //Updates user to admin
        mysqli_query($db_handle, $query) or die(mysqli_error($db_handle));
        header ("Location: /public_html/HTML/memberlist.html");
}

Thank you all for the suggestions.

HTML form not updating mySQL through PHP file

1 Answers1