If my post is empty, how do i block the update with my database?

Question

I have this problem with mysql on phpmyadmin databases that I want to update my database, for instance change the username, but with the current code I have, if I leave something empty, it updates the database with empty value, I wanted to change this that IF the post is empty it doesnt update the database to empty space

here is my code:

<!doctype html>
<?php
$servername = "localhost";
$username = "root";
$password = "";
$dbname = "eerstedatabase";

//create connection
$connection = new mysqli($servername, $username, $password, $dbname);

if ($_POST) {

//check connection
if ($connection->connect_error) {
    die("Connection failed: " . $connection->connect_error);
}
//if these posts are empty it updates them to empty in the database aswell
$sql = "UPDATE gebruikers SET Gebruikersnaam='" . $_POST['Gebruikersnaam'] . "',
Wachtwoord='" . $_POST['Wachtwoord'] . "',
Email='" . $_POST['Email'] . "' 
WHERE ID='" . $_POST['ID'] . "' ";

if ($connection->query($sql) === TRUE) {
    echo "Record updated successfully";

    include 'Opdracht1.php';
} else {
    echo "Error updating record: " . $conn->error;
}
}
else
{

?>
<html>
<head>
<meta charset="utf-8">
<title>Naamloos document</title>
</head>

<body>
<center>
<table>
<form name="update" action="OpdrachtDW6.php" method="POST">
  <tr>
    <td>ID</td>
    <td><input type="text" name="ID" rquired /></td>
  </tr>
  <tr>
    <td>Gebruikersnaam</td>
    <td><input type="text" name="Gebruikersnaam" required /></td>
  </tr>
  <tr>
    <td>Wachtwoord</td>
    <td><input type="text" name="Wachtwoord" required /></td>
  </tr>
  <tr>
    <td>Email</td>
    <td><input type="text" name="Email" required /></td>
  </tr>
  <tr>
    <td><input type="submit" value="Updaten" /></td>
  </tr>
  </td>
</form>
</center>
</body>
</html>

<?php
}
?>

You are open to SQL injections with this code. http://php.net/manual/en/mysqli.quickstart.prepared-statements.php — chris85, Mar 31 '16 at 15:42
`if(condition) { do something } else { well, do something else }` with optional `AND|OR`. — Funk Forty Niner, Mar 31 '16 at 15:44
You could also alter your column(s) to not accept NULL values. — Funk Forty Niner, Mar 31 '16 at 15:45
`if empty ($var) AND|OR empty ($var) AND|OR empty ($var)` *blah blah blah* or the reverse of that `if not empty ($var) AND|OR not empty ($var) AND|OR not empty ($var)`. There, now you've been given the basic structure on how to build it. Consult the manual http://php.net/manual/en/function.empty.php — Funk Forty Niner, Mar 31 '16 at 15:55
@Fred-ii- do i do this trough phpmyadmin? or in the php code? — Jake Imhoff, Mar 31 '16 at 15:56
You do this through PHP. phpmyadmin has nothing to do with these kinds of conditions, unless you were to use standard SQL syntax with no variables in phpmyadmin. — Funk Forty Niner, Mar 31 '16 at 15:57
hold on, I'll write something up for you. edit: you're welcome. — Funk Forty Niner, Mar 31 '16 at 15:59
@JakeImhoff I've posted something for you below as a basic logic. See the commented code to process as desired. — Funk Forty Niner, Mar 31 '16 at 16:03

score 0 · Answer 1 · edited Mar 31 '16 at 15:44

0

You need to check the value of the $_POST fields on the server side.

$errs = false;

if ($_POST['ID'] == "") { 
   $errs = true;
   echo "ID Field Missing";
}
if ($_POST['Gebruikersnaam'] == "") { 
   $errs = true;
   echo "Gebruikersnaam Field Missing";
}

/* And so on... */

if (!$errs) {
    //check connection
    if ($connection->connect_error) {
       die("Connection failed: " . $connection->connect_error);
    }

    $sql = "UPDATE gebruikers SET Gebruikersnaam='" . $_POST['Gebruikersnaam'] . "',
    Wachtwoord='" . $_POST['Wachtwoord'] . "',
    Email='" . $_POST['Email'] . "' 
    WHERE ID='" . $_POST['ID'] . "' ";

    if ($connection->query($sql) === TRUE) {
       echo "Record updated successfully";

       include 'Opdracht1.php';
    } else {
       echo "Error updating record: " . $conn->error;
    }
}

edited Mar 31 '16 at 15:44

chris85

23,846
7
34
51

answered Mar 31 '16 at 15:40

omnichad

1,635
1
11
10

yes, but, this means that you need to fill in those forms, i want it to be that if you dont fill them in the code doesnt update the database – Jake Imhoff Mar 31 '16 at 15:45
You have them set as required in your HTML code. Most web browsers won't give the user the choice anyway. You must remove `required` from the form fields. And if you want it to silently fail with no error messages, just remove the lines that echo an error out to the user. – omnichad Mar 31 '16 at 16:42

score 0 · Answer 2 · answered Mar 31 '16 at 15:41

0

you can check if the POST values are empty or not:

if(empty($_POST['Email'])
    // Do something

There are other options like check the length of string, if the name is too short, maybe it is not acceptable. Hope this help.

answered Mar 31 '16 at 15:41

Tu DUONG

94
3

this is what i want to do but, how do I tell the php code to not update if(empty($_POST['Email']) don't update – Jake Imhoff Mar 31 '16 at 15:43

score 0 · Answer 3 · answered Mar 31 '16 at 15:59

You can use this logic

if(isset($_POST['Email'])){
    //post email is not empty! and you can insert in database!
    if ($connection->query($sql) === TRUE) {
        echo "Record updated successfully";
        include 'Opdracht1.php';
    } else {
        echo "Error updating record: " . $conn->error;
    }
}

score 0 · Answer 4 · edited May 23 '17 at 12:31

Here is the (basic) logic to check against (not) empty fields.

Sidenote: See comments in code to process as desired.

if( !empty($_POST['ID']) 

 && !empty($_POST['Gebruikersnaam']) 
 && !empty($_POST['Wachtwoord']) 
 && !empty($_POST['Email']) 

  )

 {

 // Execute the query

 }

 else {

 // kill the process or do something else

 }

If you only want to perform the UPDATE if only the email is empty, then simply do:

if(!empty($_POST['Email'])) {

    $sql = "UPDATE gebruikers ...

    // Rest of your code

}

Consult the following on PHP's logical operators:

http://php.net/manual/en/language.operators.logical.php

and empty():

http://php.net/manual/en/function.empty.php

Footnotes:

Your present code is open to SQL injection. Use prepared statements, or PDO with prepared statements.

Also on doing an UPDATE and to check if it truly was successful, use mysqli_affected_rows():

http://php.net/manual/en/mysqli.affected-rows.php

as if ($connection->query($sql) === TRUE) could give you a false positive.

You can also alter your column(s) to not accept NULL values.

Consult http://dev.mysql.com/doc/refman/5.7/en/working-with-null.html

and making it/them as NOT NULL.

On an added note, this if ($_POST) { could be changed to if(isset($_POST['submit'])){ and adding the submit name attribute to your submit button.

<input type="submit" name="submit" value="Updaten" />

Thank you for your help, im trying this out atm, this will not update the fields in my database if they're empty — Jake Imhoff, Mar 31 '16 at 16:08
@JakeImhoff Exactly and you're welcome. On an added note and as I posted in comments, you can also alter your column(s) to not accept NULL values and just deal on the level error. Plus, and something I will add to my answer is to use `mysqli_affected_rows()` http://php.net/manual/en/mysqli.affected-rows.php for actual truthness if the update was truly successful. — Funk Forty Niner, Mar 31 '16 at 16:09
Sidenote to editing: I appreciate the edits for my answer but it's fine just the way it is, *thanks*. I'll edit the first line, there ;-) — Funk Forty Niner, Mar 31 '16 at 16:17
@JakeImhoff So, how are you making out? I also made a few edits to my answer so you might want to reload it. — Funk Forty Niner, Mar 31 '16 at 16:30

score 0 · Answer 5 · answered Mar 31 '16 at 16:11

What I've done before is build my query into variables, then if a variable is empty it will skip that bit of the query.

For example

if($_POST['fielda']) {
    $fieldasql = "fielda = '".$_POST['fielda']."',";
} else {
    $fieldasql = "";  
}

if($_POST['fieldb']) {
    $fieldbsql = "fieldb = '".$_POST['fieldb']."',";
} else {
    $fieldbsql = "";  
}

then your query would be:

$sql = "UPDATE gebruikers SET " . $fieldasql . " " . $fieldbsql;

If my post is empty, how do i block the update with my database?

5 Answers5