0

I've been tasked to fix a problem on our website and I'm not very well versed in SQL/PHP but we have a system that uses a front page datatable, displaying records from our database. When you click a serial number link in that table, it brings up a web based form/tables filled by the data from the specified record. I've now been told to make two of the tables editable so that it still shows the current fields from the database, but this way we would have the option to change them, hit the submit button and save the new values to the database.

The code below covers the instance from the front page and the query that selects the right row from our 'staging' database table and displays the info from only that record. This works fine and since I upded the code with input tags I can now edit the fields, but I've yet to implement the option to save them.

If I understand right, I would create a 'Submit' button on this page (although I was thinking of an option that may have a save button for every html table) and when the button is pressed, I would attach a SQL UPDATE statement.

I have two questions here:

  1. If I were to edit every one of the input fields in the below code, what is the proper way to run that UPDATE statement to properly set each of those values?

  2. If you see below, I have a formula that averages some values and I put that result in $testFinalForm. This is all done on the web page and that value doesn't exist in the database table. If I were to add testFinalForm to my database table, I would like to save that value as well.

Again, this is not something I usually have to do and I'm a bit overwhelmed so I'm just hoping for some helpful guidance.

if(isset($_GET['id'])) 
{

$query1 = "SELECT * FROM staging WHERE serialNumber = ".$_REQUEST['id'].";";
$result1 = mysqli_query($connect,$query1);

while($row = mysqli_fetch_array($result1)){
?>
<form>

<!--Meter Test (1) Table-->
<div class="FirstMeterTable" style=" width:100%; clear: both;">
<table style="width:100%; border:none;
border-collapse:collapse;">



    <tr style="border:none;">
        <th style="border:none; text-align: left;" >Meter Test</th>
        <th style="border:none;">Test 1</th>
        <th style="border:none;">Test 2</th>
        <th style="border:none;">Test 3</th>
        <th style="border:none;">Test 4</th>
        <th style="border:none;">Test 5</th>
        <th style="border:none;">Test 6</th>
        <th style="border:none;">Test 7</th>
        <th style="border:none;">Test 8</th>
    </tr>
    <tr style="border: none;" >
        <td style="border:none; text-align: left;">Test Rate GPM: </td>
        <td><input type="text" value="<? echo $row['test1TestRateGPM'];?>">&nbsp;</td>
        <td><input type="text" value="<? echo $row['test2TestRateGPM'];?>">&nbsp;</td>
        <td><input type="text" value="<? echo $row['test3TestRateGPM'];?>">&nbsp;</td>
        <td><input type="text" value="<? echo $row['test4TestRateGPM'];?>">&nbsp;</td>
        <td><input type="text" value="<? echo $row['test5TestRateGPM'];?>">&nbsp;</td>
        <td><input type="text" value="<? echo $row['test6TestRateGPM'];?>">&nbsp;</td>
        <td><input type="text" value="<? echo $row['test7TestRateGPM'];?>">&nbsp;</td>
        <td><input type="text" value="<? echo $row['test8TestRateGPM'];?>">&nbsp;</td>

    </tr>
    <tr>
        <td style="border:none; text-align: left;">Meter Volume: </td>
        <td><input type="text" value="<? echo $row['test1MeterVol'];?>">&nbsp;</td>
        <td><input type="text" value="<? echo $row['test2MeterVol'];?>">&nbsp;</td>
        <td><input type="text" value="<? echo $row['test3MeterVol'];?>">&nbsp;</td>
        <td><input type="text" value="<? echo $row['test4MeterVol'];?>">&nbsp;</td>
        <td><input type="text" value="<? echo $row['test5MeterVol'];?>">&nbsp;</td>
        <td><input type="text" value="<? echo $row['test6MeterVol'];?>">&nbsp;</td>
        <td><input type="text" value="<? echo $row['test7MeterVol'];?>">&nbsp;</td>
        <td><input type="text" value="<? echo $row['test8MeterVol'];?>">&nbsp;</td>
    </tr>
    <tr>
        <td style="border:none; text-align: left;">Tester Volume: </td>
        <td><input type="text" value="<? echo $row['test1TesterVol'];?>">&nbsp;</td>
        <td><input type="text" value="<? echo $row['test2TesterVol'];?>">&nbsp;</td>
        <td><input type="text" value="<? echo $row['test3TesterVol'];?>">&nbsp;</td>
        <td><input type="text" value="<? echo $row['test4TesterVol'];?>">&nbsp;</td>
        <td><input type="text" value="<? echo $row['test5TesterVol'];?>">&nbsp;</td>
        <td><input type="text" value="<? echo $row['test6TesterVol'];?>">&nbsp;</td>
        <td><input type="text" value="<? echo $row['test7TesterVol'];?>">&nbsp;</td>
        <td><input type="text" value="<? echo $row['test8TesterVol'];?>">&nbsp;</td>
    </tr>
    <tr>
        <td style="border:none; text-align: left;">Tester Accuracy: </td>
        <td><input type="text" value="<? echo $row['test1Accuracy'];?>">%&nbsp;</td>
        <td><input type="text" value="<? echo $row['test2Accuracy'];?>">%&nbsp;</td>
        <td><input type="text" value="<? echo $row['test3Accuracy'];?>">%&nbsp;</td>
        <td><input type="text" value="<? echo $row['test4Accuracy'];?>">%&nbsp;</td>
        <td><input type="text" value="<? echo $row['test5Accuracy'];?>">%&nbsp;</td>
        <td><input type="text" value="<? echo $row['test6Accuracy'];?>">%&nbsp;</td>
        <td><input type="text" value="<? echo $row['test7Accuracy'];?>">%&nbsp;</td>
        <td><input type="text" value="<? echo $row['test8Accuracy'];?>">%&nbsp;</td>
        <td style="border:none;">Overall</td>
    </tr>
    <tr>
        <td style="border:none; text-align: left;">Corrected Accuracy: </td>

            <?php 
        $sum=0;


        for($i=1; $i<=8; $i++){ 


        if($row["test".$i."TesterVol"] == 0){
        $row["test".$i."TesterVol"] = 0.001;
        }

        $testFormA = $row["test".$i."MeterVol"] / $row["test".$i."TesterVol"]; 
        $testFormB = $testFormA * $row["test".$i."Accuracy"]; 
        $testFinalForm = $testFormB;
        $sum += $testFinalForm; 

        ?>
        <td><?php echo round($testFinalForm,3) ?>%</td>


        <?php }
        $average = $sum / 7 ;

        ?>

        <td><?php echo round($average,5)?>%&nbsp;</td>

    </tr>
</table>
</div>
<br>
<br>
</form>
SaidbakR
  • 13,303
  • 20
  • 101
  • 195
Geoff_S
  • 4,917
  • 7
  • 43
  • 133
  • 1
    **Danger**: You are **vulnerable to [SQL injection attacks](http://bobby-tables.com/)** that you need to [defend](http://stackoverflow.com/questions/60174/best-way-to-prevent-sql-injection-in-php) yourself from. – Quentin Jun 07 '17 at 15:45
  • 1
    "If I were to edit every one of the input fields in the below code, what is the proper way to run that UPDATE statement to properly set each of those values?". Define "proper". Obviously you have to read those values from the POST variables, validate them, and then write an UPDATE statement which includes them all. You should use proper data validation and parameterised queries to protect from injection attacks. If you need more than one UPDATE to complete the work, wrap all the statements in a transaction to ensure data integrity. – ADyson Jun 07 '17 at 15:55
  • 1
    why do you want/need to save the average? It can just be recalculated each time the page is run. Storing data which can be derived from other data is generally considered bad practise (due to the risks of data de-normalisation, duplication, stale values) unless that derivation takes a very large amount of time to complete. – ADyson Jun 07 '17 at 15:57
  • That's actually a good point. the average could just be recalculated with all the current values. So for the first question, as a fix for now, I could run an UPDATE setting each corresponding db table value where the current PHP value is? – Geoff_S Jun 07 '17 at 15:59
  • @ADyson I think I found the best statement just using UPDATE and equating my DB column names with the POST names so it should work for now. Thank you! – Geoff_S Jun 07 '17 at 18:16
  • no problem. remember also to validate the data before you run the query, so it doesn't break any business logic, and doesn't allow SQL injection attacks. You can't assume that anything coming from the user is correct. – ADyson Jun 07 '17 at 19:17

0 Answers0