0

I am currently trying to create a webpage which can edit details of members of a club. I have a button that Revokes their access to the club. This button is displayed in each row of the HTML table. When the button is pressed, it triggers the function revoke() and should update the database to make their status "revoked".

However in my PHP, i can't seem to be able to get it to work in the WHERE clause. It should be WHERE intID = "whatever their id is" but it doesn't work. I think this is because i am having trouble passing the ID to the SQL statement.

Here is my code:

function revoke(intID1){
    <?php
    $intID=intID1;

    $conn = new mysqli("my server name", "username", "pword", "database");
    if ($conn->connect_error) {
        die("Connection failed: " . $conn->connect_error);
    } 
    $sql = "UPDATE `members` SET `Status`='Revoked' WHERE `intID`=$intID";

    if ($conn->query($sql) === TRUE) {
        echo "alert('Record updated successfully')";
    } else {
        echo "alert('Error updating record')". $conn->error;
    }
    $conn->close();
    ?>
}

I am pretty sure the trouble lays in this line:

$sql = "UPDATE `members` SET `Status`='Revoked' WHERE `intID`=$intID";

I have tried changing the $intID to '$intID' and messing around with quotation marks but still can't get it to work. I have even tried using intID1 which is the one originally passed into the function.

I have looked around and found bits about the mysql real escape string but couldn't get that to work either.

Hopefully you guys can help. Thanks in advance.

Harry B
  • 61
  • 12
  • 2
    You can't use a JavaScript variable in PHP like that, use AJAX instead. – Rajdeep Paul Jul 29 '18 at 20:05
  • if you want to update the row on button click, you need to use ajax to call a backend php script which updates the table – Juakali92 Jul 29 '18 at 20:06
  • @RajdeepPaul thank you, I haven’t used AJAX before (I’m an iOS developer) would you be able to answer the question with a method? – Harry B Jul 29 '18 at 20:07
  • 1
    https://api.jquery.com/jquery.post/ and please use pdo and prepare statments https://websitebeaver.com/php-pdo-prepared-statements-to-prevent-sql-injection, if u have only this tiny statment u also can protect the statment with (int)$intID but remmber thaht u never pass user varibles direct to db – StefanBD Jul 29 '18 at 20:08
  • HarryB, @StefanBD has already given enough hints. Please try those. :-) – Rajdeep Paul Jul 29 '18 at 20:14

0 Answers0