0

I'm trying to make an update.php

Here's the code 

$nama = $_POST['nama'];
$noic = $_POST['noic'];
$jantina = $_POST['jantina'];
$kelas = $_POST['kelas'];
$persatuan = $_POST['persatuan'];
$jawatan = $_POST['jawatan'];
$namapenjaga = $_POST['namapenjaga'];
$notel = $_POST['notel'];
$alamat = $_POST['alamat'];
$gurupenasihat = $_POST['gurupenasihat'];

$query = "UPDATE daftarpelajar SET nama='$nama', noic='$noic', jantina='$jantina', kelas='$kelas', persatuan='$persatuan', jawatan='$jawatan', namapenjaga='$namapenjaga', notel='$notel', alamat='$alamat', gurupenasihat='$gurupenasihat' WHERE noic='$noic'";

$result = mysqli_query($connect, $query);

if($result == TRUE)
    echo "Rekod $noic berjaya di kemaskini";
else
    echo "Rekod tidak berjaya dikemaskini<br><br>";
    echo "<a href=senarai_pelajar.php>Kembali</a>";

mysqli_close($connect);
Maxime Chéramy
  • 17,761
  • 8
  • 54
  • 75
Triggered360
  • 1
  • What's the error? – Maxime Chéramy May 13 '18 at 15:31
  • don't forget the `{` `}` in your `else` – Maxime Chéramy May 13 '18 at 15:32
  • *Side note*: Your code seems to be vulnerable to [mysql injection](http://php.net/manual/en/security.database.sql-injection.php) Please make sure your queries are secure by using 'Prepared statements' from either [mysqli_*](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) or, personally preferred, [PDO](http://php.net/manual/en/pdo.prepared-statements.php) – Joas May 13 '18 at 15:39

0 Answers0