0

I am trying to update a table in my database. It looks up a row via a HogId number, and updates the row. All columns will update but the PetName column. I checked and the variable is set, the HogId is correct and all columns match the table. What am I missing? I am not done yet, as I haven't done some security stuff to do as well.

<?php
session_start();
require_once('../mysqlconnect.php');

//ini_set('display_errors', 1);
//ini_set('display_startup_errors', 1);
//error_reporting(E_ALL);
?>

<?php

if(isset($_SESSION['HHAdminUserId'])&&isset($_SESSION['HHAdminName'])){     

    mysqli_query($link, "SET AUTOCOMMIT = 0");
        $PetName = $_POST['PetName'];
        $BirthDate = $_POST['BirthDate'];
        $Descriptors = $_POST['Descriptors'];
        $Sex = $_POST['Sex'];
        $Breeder = $_POST['Breeder'];
        $OwnedBy = $_POST['Owner'];
        $HogId = $_POST['HogId'];

        //All areas that need updated when HogId for a hedgehog changes
        if(isset($_POST['changeBreeder'])){
            $HogIdEx = explode("-",$HogId);
            $HogIdOld = $HogIdEx[0];
            $UpdatedHogId = $Breeder."-".$HogIdEx[1];

                $UpdateBasic = "UPDATE HedgehogBasic set HogId = '$UpdatedHogId' WHERE HogId = '$HogId' limit 1";
                $execUpdateBasic = @mysqli_query($link, $UpdateBasic);
                    if(!$execUpdateBasic){
                        rollback_die("The inquiry could not be completed because : ");
                            }else{
                                echo "Change in 'HedgehogBasic' table Successful!<br />";
                            }

                $UpdateTransfer = "UPDATE Transfer set HogId = '$UpdatedHogId' WHERE HogId = '$HogId'";
                $execUpdateTransfer = @mysqli_query($link, $UpdateTransfer);
                    if(!$execUpdateTransfer){
                        rollback_die("The inquiry could not be completed because : ");
                            }else{
                                echo "Change in 'Transfer' table Successful!<br />";
                            }
                $UpdateUnknownLine = "UPDATE UnknownLine set HogId = '$UpdatedHogId' WHERE HogId = '$HogId'";
                $execUpdateUnknownLine = @mysqli_query($link, $UpdateUnknownLine);
                    if(!$execUpdateUnknownLine){
                        rollback_die("The inquiry could not be completed because : ");
                            }else{
                                echo "Change in 'UnknownLine' table Successful!<br />";
                            }

                $UpdatePhotos = "UPDATE Photos set HogId = '$UpdatedHogId' WHERE HogId = '$HogId'";
                $execUpdatePhotos = @mysqli_query($link, $UpdatePhotos);
                    if(!$execUpdatePhotos){
                        rollback_die("The inquiry could not be completed because : ");
                            }else{
                                echo "Change in 'Photos' table for HogId Successful!<br />";
                            }

                function UpdateBreeding($BreedingCol, $UpdatedHogId, $HogId){
                global $link;
                $UpdateBreeding = "UPDATE Breeding SET $BreedingCol = '$UpdatedHogId' WHERE $BreedingCol = '$HogId'";
                $execUpdateBreeding = @mysqli_query($link, $UpdateBreeding);
                    if(!$execUpdateBreeding){
                        rollback_die("The inquiry could not be completed because : ");
                            }else{
                                echo "Change in 'Breeding' table for $BreedingCol Successful!<br />";
                            }
                }

                UpdateBreeding ('HogletHogId', $UpdatedHogId, $HogId);
                UpdateBreeding ('BoarHogId', $UpdatedHogId, $HogId);
                UpdateBreeding ('SowHogId', $UpdatedHogId, $HogId);


                $UpdatePhotosImg = "SELECT Link FROM Photos WHERE HogId = '$UpdatedHogId' ";
                $execUpdatePhotosImg = @mysqli_query($link, $UpdatePhotosImg);
                    if(!$execUpdatePhotosImg){
                        rollback_die("The inquiry could not be completed because : ");
                            }else{
                                while($one_row = mysqli_fetch_assoc($execUpdatePhotosImg)){
                                    $Link = $one_row['Link'];
                                    $UpdatedLink = str_replace("$HogIdOld","$Breeder","$Link");

                                $UpdatePhotosLink = "UPDATE Photos set Link = '$UpdatedLink' WHERE HogId = '$UpdatedHogId'";
                                $execUpdatePhotosLink = @mysqli_query($link, $UpdatePhotosLink);
                                    if(!$execUpdatePhotosLink){
                                        rollback_die("The inquiry could not be completed because : ");
                                            }else{
                                                echo "Change in 'Photos' table for Link Successful!<br />";
                                            }   
                                }
                            }

            $HogId = $UpdatedHogId;
            }

        $Update = "UPDATE HedgehogBasic SET BirthDate ='$BirthDate', Descriptors = '$Descriptors', Sex = '$Sex', Breeder = '$Breeder', OwnedBy = '$OwnedBy', PetName = '$PetName' WHERE HogId = '$HogId' Limit 1";
        $execUpdate = @mysqli_query($link, $Update);

    if(!$execUpdate){
        rollback_die("The inquiry could not be completed because : ");
            }else{
                echo "Update Successful!<br />";
            }
  • 1
    **Your code is vulnerable to SQL injection and will be hacked** even if [you are escaping inputs!](https://stackoverflow.com/a/5741264/2595450) Use [Prepared Statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) instead. – Spoody Apr 09 '18 at 19:12
  • 2
    Don't use the `@` operator and solve errors instead. – Spoody Apr 09 '18 at 19:12
  • Have you tried to `var_dump($_POST);`? or `if (!isset($_POST['PetName'])) die('PetName not posted!');`? – Syscall Apr 09 '18 at 19:24
  • I just did: ` array(7) { ["PetName"]=> string(3) "Rey" ["BirthDate"]=> string(10) "2017-10-08" ["Descriptors"]=> string(0) "" ["Sex"]=> string(6) "Female" ["Breeder"]=> string(3) "cmt" ["Owner"]=> string(3) "cmt" ["HogId"]=> string(40) "Pet Name was changed from Cmt Rey to Rey" } ` It says it is there? – Jennifer Chandler Apr 09 '18 at 19:32

0 Answers0