How to optimize my codes to make it faster and more user friendly?

Question

<div id="database"> 
<form action="http://localhost/database/edit.php"  method="post">
<br>Please enter the ID of item you want to edit: <input type="text" name="ID" /><br><br>
What do you want to change:<br> <br>
<input type="radio"  name="change" value="Name"/>Name<br><br>
<input type="radio"  name="change" value="Cause" size="100" />Cause <br><br>
<input type="radio"  name="change" value="Symptom" size="200" />Symptom <br><br>
<input type="radio"  name="change" value="Gene_affected" size="200" />Gene_affected <br><br>
   Change it to: <input type="text" name="New" /><br><br>
<input type="submit" onclick="clicked(event)" />
</form>
</div>

That is my databse.php

   <?php
$con = mysql_connect("localhost","root");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("database", $con);

mysql_query("UPDATE pleasework SET $_POST[change] = '$_POST[New]'
WHERE ID='$_POST[ID]'");
echo "Change Successful<br>" ;
header("Location: databse.php");
mysql_close($con);
?>

That is my edit.php

How can I change all my boxes in the table using 1 query? //////////////////////////////////////////////////////////

<div id="database"> 
<form action="http://localhost/database/edit.php"  method="post">
<br>Please enter the ID of item you want to edit: <input type="text" name="ID" /><br><br>
What do you want to change:<br> <br>
   Change Name to: <input type="text" name="New" /><br><br>
   Change Cause to: <input type="text" name="New1" /><br><br>
   Change Symptom to: <input type="text" name="New2" /><br><br>
   Change Gene_affected to: <input type="text" name="New3" /><br><br>
<input type="submit" onclick="clicked(event)" />
</form>
</div>

this is my new main php file. I manage to make it update all 4 boxes at once but its still so unreliable and slow. Help please?

mysql_select_db("database", $con);

mysql_query("UPDATE pleasework SET Name= '$_POST[New]' WHERE ID='$_POST[ID]'");
mysql_query("UPDATE pleasework SET Cause= '$_POST[New1]' WHERE ID='$_POST[ID]'");
mysql_query("UPDATE pleasework SET Symptom= '$_POST[New2]' WHERE ID='$_POST[ID]'");
mysql_query("UPDATE pleasework SET Gene_affected= '$_POST[New3]' WHERE ID='$_POST[ID]'");
 echo "Change Successful<br>" ;
 header("Location: databse.php");
 mysql_close($con);

Any suggestions to help me improve my codes? Thank you!

[Your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [PDO](http://php.net/manual/en/pdo.prepared-statements.php) and [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) and consider using PDO, [it's really pretty easy](http://jayblanchard.net/demystifying_php_pdo.html). — Jay Blanchard, Jan 29 '16 at 18:27
I updated my answer with a specific solution for your question. — Math, Jan 29 '16 at 19:15

Math · Accepted Answer · 2016-01-29T19:13:55.260

mysql_ functions are deprecated, you should consider to use msqli_ or pdo

Here's how to update multiple fields with mysqli_

$conn = $mysqli->prepare("UPDATE pleasework SET 
   field1 = ?,  
   field2 = ?  
   WHERE ID = ?");
$conn->bind_param(
   $_POST['value1'],
   $_POST['value2'],
   $_POST['id']);
$conn->execute(); 
$conn->close();

Now that you're aware that mysql_ is deprecated, here's the solution you were looking for:

$sql = "UPDATE pleasework SET column_name1='value', column_name2='value' WHERE ID='$_POST[ID]'";

score 0 · Answer 2 · answered Jan 29 '16 at 18:35

Have you thought about using a checkbox instead of radio inputs? For example:

Then on PHP side you would have this query:

$change_fields = array('Name', 'Cause', 'Symptom', 'Gene_affected');
$query = '';
foreach(change_fields as $field) {
    if(isset($_POST[field])) {
        $query .= ",$_POST[field] = '$_POST[New]'";
    }
}
$query = rtrim(query, ',');

if(!empty($query)) {
     mysql_query("UPDATE pleasework SET $query WHERE ID=$_POST[ID]");")
}

Normally I would excape these values and use some kind of wrapper database class, but that's something you want to do after you're comfortable with this.

How to optimize my codes to make it faster and more user friendly?

2 Answers2