-2

I'm trying to build a SELECT query that allows me to use the form the results are returned in to process an UPDATE to a selected row. The warning I'm receiving appears on line 36 of my code. I thought I set the code up correctly to build the table, then populate it, but I can't find my error. I saw several versions of this quetions asked, but I didn't see one that talked about object given. Any help would be appeciated.

<html>
<head>
</head>
<body>
<?php
$servername = "localhost";
$username = "xxx";
$password = "xxx";
$dbname = "oldga740_SeniorProject";
// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
     die("Connection failed: " . $conn->connect_error);
}
$sql = "SELECT * FROM Projects";
$result = $conn->query($sql);
echo "<table border=1>
<tr>
<th>Project</th>
<th>Client</th>
<th>Last Name</th>
<th>Date Received</th>
<th>Final Review Date</th>
<th>Date Delivered</th>
<th>Date Accepted>
</tr>";
while($record = mysql_fetch_array($result))
{
if ($result->num_rows > 0){
echo "<form action=mynewform.php method=post>";
echo "<tr>"; 
echo "<td>" . "<input type=text name=project value=" . $record['Project'] . " </td>";
echo "<td>" . "<input type=text name=client value=" . $record['Client'] . " </td>";
echo "<td>" . "<input type=text name=lastname value=" . $record['LastName'] . " </td>";
echo "<td>" . "<input type=text name=datereceived value=" . $record['DateReceived'] . " </td>";
echo "<td>" . "<input type=text name=finalreview date value=" . $record['FinalReviewDate'] . " </td>";
echo "<td>" . "<input type=text name=datedelivered value=" . $record['DateDelivered'] . " </td>";
echo "<td>" . "<input type=text name=dateaqccepted value=" . $record['DateAccepted'] . " </td>";
echo "<td>" . "<input type=hidden name=hidden value=" . $record['Project'] . " </td>";
echo "<td>" . "<input type=submit name=update value=update" . " </td>";
echo "<td>" . "<input type=submit name=delete value=delete" . " </td>";
echo "</tr>";
echo "</form>";
}
}
echo "</table>";
if (isset($_POST[update])){
$UpdateQuery = "UPDATE Projects SET Project='$_POST[project]', Client='$_POST[client]', LastName='$_POST[lastname]', DateReceived='$_POST[datereceived]', FinalReviewDate='$_POST[finalreviewdate]', DateDelivered='$_POST[datedelivered]', DateAccepted='$_POST[dateaccepted]' WHERE Project='$_POST[hidden]";
mysql_query($UpdateQuery, $con);
}; 
?>
<?php
    $connection->close();
?>
</body>
</html>

EDITED CODE

<html>

<head>

</head>

<body>

<?php
$servername = "localhost";
$username = "xxx";
$password = "xxx";
$dbname = "oldga740_SeniorProject";

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
     die("Connection failed: " . $conn->connect_error);
}

$sql = "SELECT * FROM Projects";
$result = $conn->query($sql);

echo "<table border=1>
<tr>
<th>Project</th>
<th>Client</th>
<th>Last Name</th>
<th>Date Received</th>
<th>Final Review Date</th>
<th>Date Delivered</th>
<th>Date Accepted</th>
</tr>";

while($record = mysqli_fetch_array($result))
{
if ($result->num_rows > 0){

echo "<form action='mynewform'.php method='post'>";
echo "<tr>"; 
echo "<td>" . "<input type='text' name='project' value='" . $record['Project'] . " </td>";
echo "<td>" . "<input type='text' name='client' value='" . $record['Client'] . " </td>";
echo "<td>" . "<input type='text' name='lastname' value='" . $record['LastName'] . " </td>";
echo "<td>" . "<input type='text' name='datereceived' value='" . $record['DateReceived'] . " </td>";
echo "<td>" . "<input type='text' name='finalreviewdate' value='" . $record['FinalReviewDate'] . " </td>";
echo "<td>" . "<input type='text' name='datedelivered' value='" . $record['DateDelivered'] . " </td>";
echo "<td>" . "<input type='text' name='dateaccepted' value='" . $record['DateAccepted'] . " </td>";
echo "<td>" . "<input type='hidden' name='hidden' value='" . $record['Project'] . " </td>";
echo "<td>" . "<input type='submit' name='update' value=update'" . " </td>";
echo "<td>" . "<input type='submit' name='delete' value=delete'" . " </td>";
echo "</tr>";
echo "</form>";
}
}
echo "</table>";

if (isset($_POST['update'])){
$UpdateQuery = "UPDATE Projects SET Project='$_POST[project]', Client='$_POST[client]', LastName='$_POST[lastname]', DateReceived='$_POST[datereceived]', FinalReviewDate='$_POST[finalreviewdate]', DateDelivered='$_POST[datedelivered]', DateAccepted='$_POST[dateaccepted]' WHERE Project='$_POST[hidden]";
mysqli_query($conn, $sql);
}; 

?>

<?php
    $conn->close();
?>

</body>

</html>

SECOND EDIT

<html>

<head>

</head>

<body>

<?php
$servername = "localhost";
$username = "xxx";
$password = "xxx";
$dbname = "oldga740_SeniorProject";

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
     die("Connection failed: " . $conn->connect_error);
}

$sql = "SELECT * FROM Projects";
$result = $conn->query($sql);

echo "<table border=1>
<tr>
<th>Project</th>
<th>Client</th>
<th>Last Name</th>
<th>Date Received</th>
<th>Final Review Date</th>
<th>Date Delivered</th>
<th>Date Accepted</th>
</tr>";

while($record = mysqli_fetch_array($result))
{
if ($result->num_rows > 0){

echo "<form action='mynewform.php' method='post'>";
echo "<tr>"; 
echo "<td>" . "<input type='text' name='project' value='" . $record['Project'] . "' /></td>";
echo "<td>" . "<input type='text' name='client' value='" . $record['Client'] . "'/></td>";
echo "<td>" . "<input type='text' name='lastname' value='" . $record['LastName'] . "' /></td>";
echo "<td>" . "<input type='text' name='datereceived' value='" . $record['DateReceived'] . "' /></td>";
echo "<td>" . "<input type='text' name='finalreviewdate' value='" . $record['FinalReviewDate'] . "' /></td>";
echo "<td>" . "<input type='text' name='datedelivered' value='" . $record['DateDelivered'] . "' /></td>";
echo "<td>" . "<input type='text' name='dateaccepted' value='" . $record['DateAccepted'] . "' /></td>";
echo "<td>" . "<input type='hidden' name='hidden' value='" . $record['Project'] . "' /></td>";
echo "<td>" . "<input type='submit' name='update' value=update'" . "' /></td>";
echo "<td>" . "<input type='submit' name='delete' value=delete'" . "' /></td>";
echo "</tr>";
echo "</form>";
}
}
echo "</table>";

if (isset($_POST['update'])){
$UpdateQuery = "UPDATE Projects SET Project='$_POST[project]', Client='$_POST[client]', LastName='$_POST[lastname]', DateReceived='$_POST[datereceived]', FinalReviewDate='$_POST[finalreviewdate]', DateDelivered='$_POST[datedelivered]', DateAccepted='$_POST[dateaccepted]' WHERE Project='$_POST[hidden]";
mysqli_query($conn, $sql);
}; 

?>

<?php
    $conn->close();
?>

</body>

</html>
Tony
  • 298
  • 3
  • 17
  • 2
    You have a few errors. One is you are mixing `mysql_` driver with `mysqli`. Another is that `$connection` is undefined. You also are open to SQL injections. a) `mysql_fetch_array` b) `mysql_query` – chris85 Dec 01 '15 at 04:17
  • Additionally your HTML elements are invalid you are missing the closing tags and you attributes should be quoted. (not a current issue but will be once you get the SQL processing). – chris85 Dec 01 '15 at 04:25
  • @chris85, I thought I caught all of those, but I'll go back and check. I went back and fixed $connection. Thanks. Any idea about the error I postd in the title? – Tony Dec 01 '15 at 04:35
  • 2
    Yes, that is the first error I mentioned; `you are mixing mysql_ driver with mysqli` So `$result` is a `mysqli` result object; `mysql_` functions wont work with it. Take a look at http://php.net/manual/en/mysqli-result.fetch-array.php. – chris85 Dec 01 '15 at 04:37
  • 1
    `$result` is a mysqli query, so you can't use `mysql_fetch_array($result)` in `while($record = mysql_fetch_array($result))`. Try `while($record = $result->fetch_array())` – Sean Dec 01 '15 at 04:38
  • Possible duplicate of [warning:mysql\_fetch\_array() expects parameter 1 to be resource, object given](http://stackoverflow.com/questions/4635007/warningmysql-fetch-array-expects-parameter-1-to-be-resource-object-given) – Sean Dec 01 '15 at 04:46
  • @chris85 ok, got that hurdle cleared. Now I have to clear the closing tags for my table, but it looks like they're showing up where there are null values – Tony Dec 01 '15 at 04:50
  • @Sean yeah, I checked for duplicates and didn't see any, but when I opened this question and started getting responses I saw one in the right side bar. Most of the ones Idid see as duplicates were referencing boolean errors. – Tony Dec 01 '15 at 04:54
  • just by searching your `mysql_fetch_array() expects parameter 1 to be resource, object given` I was able to find at least 3 that were the exact same error that you had, ie. `mysql` vs `mysqli`, so I just picked the first one. – Sean Dec 01 '15 at 04:57
  • I don't doubt you Sean. I've been working on this for hours now and things are starting to run together for me. Do you mind answering a question while you're here? – Tony Dec 01 '15 at 05:04
  • What is your question? – Sean Dec 01 '15 at 05:22
  • I cleared all but two of the errors, aside from the – Tony Dec 01 '15 at 05:28
  • 1
    You need to quote keys, or php will assume they are constants. So change `if (isset($_POST[update])){` to `if (isset($_POST['update'])){` (ie. `'update'`) – Sean Dec 01 '15 at 05:41
  • I forgot that. Thanks for all of your help tonight! I'll tackle my last error tomorrow! – Tony Dec 01 '15 at 05:53

3 Answers3

0

change mysql_fetch_array($result) to $result->fetch_array()

     if ($result->num_rows > 0){



   while($record = $result->fetch_array())
    {

    echo "<form action=mynewform.php method=post>";
    echo "<tr>"; 
    echo "<td>" . "<input type=text name=project value=" . $record['Project'] . " </td>";
    echo "<td>" . "<input type=text name=client value=" . $record['Client'] . " </td>";
    echo "<td>" . "<input type=text name=lastname value=" . $record['LastName'] . " </td>";
    echo "<td>" . "<input type=text name=datereceived value=" . $record['DateReceived'] . " </td>";
    echo "<td>" . "<input type=text name=finalreview date value=" . $record['FinalReviewDate'] . " </td>";
    echo "<td>" . "<input type=text name=datedelivered value=" . $record['DateDelivered'] . " </td>";
    echo "<td>" . "<input type=text name=dateaqccepted value=" . $record['DateAccepted'] . " </td>";
    echo "<td>" . "<input type=hidden name=hidden value=" . $record['Project'] . " </td>";
    echo "<td>" . "<input type=submit name=update value=update" . " </td>";
    echo "<td>" . "<input type=submit name=delete value=delete" . " </td>";
    echo "</tr>";
    echo "</form>";
    }
    }

you can't merrage mysql and mysqli

Parth Chavda
  • 1,819
  • 1
  • 23
  • 30
  • it would make more sense to move the `if ($result->num_rows > 0)` to be outside the `while($record = $result->fetch_array())`. – Sean Dec 01 '15 at 05:11
0

You connect MYSQL by using mysqli_,and when you want to get result,still need mysqli_.

This an sample from official:

`$mysqli = new mysqli("localhost", "my_user", "my_password", "world");
/* check connection */
if ($mysqli->connect_errno){
    printf("Connect failed: %s\n", $mysqli->connect_error);
    exit();
}
$sql = "SELECT a.uid, a.role AS roleid, b.role,FROM tbl_usr a INNER JOIN tbl_memrole b ON a.role = b.id  ";
    if ($result = $mysqli->query($sql)) { 
        while($obj = $result->fetch_object()){ 
            $line.=$obj->uid; 
            $line.=$obj->role; 
            $line.=$obj->roleid; 
        }
    }
    $result->close(); 
    unset($obj); 
    unset($sql); 
    unset($query);`
rain
  • 243
  • 1
  • 8
0

Aside from the previous notes in the comments. I haven't seen any other answer/comments on your HTML elements so I will add an answer on those.

The HTML you will generate with this PHP will be invalid. Attributes need to be quoted and the input elements need to be closed.

So for example your current code

echo "<form action=mynewform.php method=post>";
echo "<tr>"; 
echo "<td>" . "<input type=text name=project value=" . $record['Project'] . " </td>";

would output:

<form action=mynewform.php method=post>
<tr>
<td><input type=text name=project value=what ever projects value is</td>

which is invalid the element named project here is never closed and its value would just be what. (or in some browsers; since mark up is invalid unexpected results should be expected)

Your PHP should be:

echo "<form action='mynewform.php' method='post'>";
echo "<tr>"; 
echo "<td>" . "<input type='text' name='project' value='" . $record['Project'] . "' /> </td>";

which should give you

<form action='mynewform.php' method='post'>
<tr>
<td><input type='text' name='project' value='what ever projects value is' /></td>

Notice how the syntax highlighting is different in the second example vs. the first.

Additionally please look at http://php.net/manual/en/mysqli.quickstart.prepared-statements.php, or a bit less secure approach but better than what you currently have, http://php.net/manual/en/mysqli.real-escape-string.php.

For a longer read on the whole topic see:
a) How can I prevent SQL injection in PHP?
b) http://php.net/manual/en/security.database.sql-injection.php
c) https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet

Update:

Here's the structure I'd take (aside from the SQL injection hole):

<?php
$servername = "localhost";
$username = "xxx";
$password = "xxx";
$dbname = "oldga740_SeniorProject";
// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}
if (isset($_POST['update'])){
    $UpdateQuery = "UPDATE Projects SET Project='$_POST[project]', Client='$_POST[client]', LastName='$_POST[lastname]', DateReceived='$_POST[datereceived]', FinalReviewDate='$_POST[finalreviewdate]', DateDelivered='$_POST[datedelivered]', DateAccepted='$_POST[dateaccepted]' WHERE Project='$_POST[hidden]";
    mysqli_query($conn, $sql);
}
$sql = "SELECT * FROM Projects";
$result = $conn->query($sql);
?>
<html>
    <head>
    </head>
    <body>
        <table border='1'>
            <tr>
                <th>Project</th>
                <th>Client</th>
                <th>Last Name</th>
                <th>Date Received</th>
                <th>Final Review Date</th>
                <th>Date Delivered</th>
                <th>Date Accepted</th>
            </tr>
<?php
if ($result->num_rows > 0){
     while($record = mysqli_fetch_array($result)) {?>
            <form action='mynewform.php' method='post'>
                <tr>
                    <td><input type='text' name='project' value='<?php echo $record['Project'];?>' /></td>
                    <td><input type='text' name='client' value='<?php echo $record['Client'];?>'/></td>
                    <td><input type='text' name='lastname' value='<?php echo $record['LastName'];?>' /></td>
                    <td><input type='text' name='datereceived' value='<?php echo $record['DateReceived'];?>' /></td>
                    <td><input type='text' name='finalreviewdate' value='<?php echo $record['FinalReviewDate'];?>' /></td>
                    <td><input type='text' name='datedelivered' value='<?php $record['DateDelivered'];?>' /></td>
                    <td><input type='text' name='dateaccepted' value='<?php echo $record['DateAccepted'];?>' /></td>
                    <td><input type='hidden' name='hidden' value='<?php echo $record['Project'];?>' /></td>
                    <td><input type='submit' name='update' value='update' /></td>
                    <td><input type='submit' name='delete' value='delete' /></td>
                </tr>
            </form>
<?php
    }
}
$conn->close();
?>
        </table>
    </body>
</html>
Community
  • 1
  • 1
chris85
  • 23,846
  • 7
  • 34
  • 51
  • Chris, thanks for the extra input. I was starting to research why my form wasn't generating any results when I saw this comment. I see where you're going with this, but when I made my changes, the table didn't render properly. – Tony Dec 01 '15 at 14:48
  • Can you update your question to show the changes you made? – chris85 Dec 01 '15 at 14:56
  • You missed the closing input elements. See `. "' /> "` in my answer. vs yours; `. " "`. – chris85 Dec 01 '15 at 15:27
  • Ok, the form is back, but I'm showing " in the update and delete buttons and it still won't pass anything to the update query. I appreciate all of your help trying to get this resolved, but I don't expect you to spend your entire day trying to help me get this figured out. – Tony Dec 01 '15 at 15:43
  • Please update the question with your updated code. Your update query is invalid you are missing the closing `'` on `WHERE Project='$_POST[hidden]`. Also that is still open to the SQL injections. I don't see where you are using the delete. You should use error reporting on these queries, and on the page itself. – chris85 Dec 01 '15 at 16:27
  • Thanks. I corrected that. I'll add in the protection for sql injection and form validation after I get this thing to work. It's only for a school project so the database is purely fictional. I haven't added the delete function yet. I was trying to get the update working first. The delete should be much simpler to set up. I posted my updated code under second edit. – Tony Dec 01 '15 at 16:38
  • The quotes are on the wrong side of the attribute for the delete and update `value=update'" . "'` should be `value='update'`; and likewise for the delete. – chris85 Dec 01 '15 at 16:44
  • Additionally note that you are executing the wrong query `mysqli_query($conn, $sql);`. You name your variable `$UpdateQuery`. – chris85 Dec 01 '15 at 16:45
  • Let us [continue this discussion in chat](http://chat.stackoverflow.com/rooms/96704/discussion-between-tony-and-chris85). – Tony Dec 01 '15 at 16:54