0

Before downvoting this question, please understand my frustration. I have been at this issue for the past 4 hours. I am working on small application for a project for uni and this error has almost caused to quit completly. My application has an Edit button in which the user can choose which row from my mysql database to edit. Once they choose it asks them to fill out the First name, Last Name, DepartmentId, and Specialty. After that if successful it will display the new field onto the page. I believe the issue is that my idDepartment is a int and the form is passing it in as a string. I have tried converting it using $idDepart = preg_replace("/[^0-9,.]/", "", $idDepart); But this does not work for me. Can someone please help. I must complete this by tonight. I will post both of my php files down below.

Update: enter image description here

index.php

<!doctype html>
<html lang="en">
  <head>
    <title>Title</title>
    <!-- Required meta tags -->
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">

    <!-- Bootstrap CSS -->
    <link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/css/bootstrap.min.css" integrity="sha384-MCw98/SFnGE8fJT3GXwEOngsV7Zt27NXFoaoApmYm81iuXoPkFOJwJ8ERdknLPMO" crossorigin="anonymous">
  </head>
  <body>
  <?php require_once 'formprocessor.php';?>
  <!-- Based on query type it will use bootstrap alert class -->
  <?php
    if (isset($_SESSION['message'])): ?>
    <div class = "alert alert-<?=$_SESSION['msg_type'] ?>">

    <?php
        // Based on the message type it will echo it and then unset the session
        echo $_SESSION['message'];
        unset($_SESSION['message']);
        ?>

    </div>
    <!-- End of if statment -->
    <?php endif ?>
  <div class = "container">

  <?php
    // Connect to databse 
    $mysqli = new mysqli('127.0.0.1', 'root', "", 'v2HospitalDB')
    or die(mysqli_error($mysqli));
    // Will select everthing from Doctor and display on the page
    $result = $mysqli->query("SELECT * FROM Doctor") or die($mysqli->error);
    ?>


    <!-- This is the format for the table with the folowing columns -->
    <div class="row justify-content-center">
        <table class="table">
            <thead>
                <tr>
                 <th> Doctor ID </th>
                 <th> First Name </th>
                 <th> Last Name</th>
                 <th> Department ID</th>
                 <th> Speciality </th>
                 <th colspan="2"> Action </th>
                </tr>
            </thead>

            <?php
    // everything is fetched from db and stored in row
      while($row = $result->fetch_assoc()):?>
        <!-- Each row will have its repsected column from the database -->
            <tr>
            <td> <?php echo $row['doctorID']; ?></td>
            <td> <?php echo $row['doctorFName']; ?></td>
            <td> <?php echo $row['doctorLname']; ?></td>
            <td> <?php echo $row['idDepartment']; ?></td>
            <td> <?php echo $row['specialty']; ?></td>


            <td>
                <a href="index.php?edit=<?php echo $row['doctorID']; ?>"
                    class="btn btn-info">Edit</a>
                <a href="formprocessor.php?delete=<?php echo $row['doctorID'];?>"
                     class="btn btn-danger">Delete</a>

            </td>
            </tr>

            <?php endwhile;
            ?>


        </table>

    </div>

    <?php

    // This function prints the array in a nice format
    function pre_r($array) {
        echo '<pre>';
        print_r($array);
        echo '</pre>';
    }
    ?>

    <div class="row justify-content-center">
    <form action="formprocessor.php" method="post">

    <!-- hidden input field for the update -->
    <input type="hidden" name="id" value="<?php echo $id; ?>">

    <div class="form-group">
    <label> First Name</label>
    <input type="text" name="fname" class="form-control" value="<?php echo $firstname;?>" placeholder="Enter First Name">
    </div>

    <div label="form-group">
    <label> Last Name</label>
    <input type="text" value="<?php echo $lastname;?>" name="lname" class="form-control" placeholder="Enter Last Name">
    </div>

    <div label="form-group">
    <label> Department ID</label>
    <input type="text" value="<?php echo $idDepart;?>" name="departmentID" class="form-control" placeholder="Enter DepartmentID">
    </div>

    <div label = "form-group">
    <label> Speciality </label>
    <input type="text" value="<?php echo $special;?>" name="speciality" class="form-control" placeholder="Enter Specialty">
    </div>

    <div class="form-group">
    <?php 
    if($update == true): ?>
    <button class="btn btn-info" type="submit" name="update">Update</button>
<?php else: ?>
    <button class="btn btn-primary" type="submit" name="save">Save</button>
<?php endif; ?>
    </div>

    </form>
    </div>
    </div>
  </body>
</html>

formprocessor.php

<?phpsession_start;


// starting a session so we can go back to main page




// Connect to mysql database 
$mysqli = new mysqli('127.0.0.1','root',"",'v2HospitalDB') or die(mysqli_error($mysqli));
// If we are not able to connect for some reason then this will run below
if (!$mysqli) {
    echo "Error: Unable to connect to MySQL." . PHP_EOL;
    echo "Error code from last connect call: " . mysqli_connect_errno() . PHP_EOL;
    echo "Error description from last connect error: " . mysqli_connect_error() . PHP_EOL;
    exit;
}
// Reset values to empty 
$firstname = "";
$lastname = "";
$departID = "";
$special =  "";
$update = false;
$id = 0;

// Check if the save button has been pressed
if(isset($_POST['save'])){
    // store columns from database
    $firstname = $_POST['fname'];
    $lastname = $_POST['lname'];
    $departID = $_POST['departmentID'];
    $special =  $_POST['speciality'];



    // Insert records into database
    $mysqli -> query("INSERT INTO Doctor(doctorFName , doctorLname , idDepartment, specialty)
     VALUES('$firstname', '$lastname', '$departID' , '$special')") or
    die($mysqli->error);

    // will show at top of screen once the record has been saved
    $_SESSION['message'] = "You have saved a record into the database";
    $_SESSION['msg_type'] = "success";

    // redirect back to the index.php after inserting records
    header("location: index.php");
}

// This will delete the record from the table based on the id
if(isset($_GET['delete'])){
    $id = $_GET['delete'];
    $mysqli->query("DELETE FROM Doctor WHERE idDepartment AND doctorID = '$id'") or die($mysqli->error);


 // When you delete a record, will show at top of screen
 $_SESSION['message'] = "You have saved a deleted a record from the database";
 $_SESSION['msg_type'] = "danger";
    // redirect back to the index page
    header("location:index.php");
    // session_destroy();




}

// If the edit button is clicked
if(isset($_GET['edit'])){
    $update = true;
    $id = $_GET['edit'];
    // change back to where doctorId and idDepartment
    $result = $mysqli->query("SELECT * FROM Doctor WHERE doctorID = '$id'") or die($mysqli->error);
    // will fetch all colums in table from the result array
    // If the record has been found in the database
    if(count($result) == 1){
        $row = $result->fetch_array();
        $firstname = $row['doctorFName'];
        $lastname = $row['doctorLname'];
        $idDepart = $row['idDepartment'];
        $special = $row['specialty'];
        //  echo (var_dump($result));


    }

     // will show at top of page when user updates the table
     $_SESSION['message'] = "Record has been selected";
     $_SESSION['msg_type'] = "info";
    //  header('location: index.php');
    //  session_destroy();

}

// If user clicks update then will insert values into columns
if(isset($_POST['update'])){
    $id = $_POST['id'];
    $firstname = $_POST['doctorFName'];
    $lastname = $_POST['doctorLname'];
    $idDepart = $_POST['idDepartment'];
    $special = $_POST['specialty'];

    $idDepart = preg_replace("/[^0-9,.]/", "", $idDepart);


    $mysqli->query("UPDATE Doctor SET doctorFName = '$firstname', 
    doctorLname = '$lastname', idDepartment = '$idDepart', 
    specialty = '$special' WHERE doctorID = $id ") or die($mysqli->error);

//   $mysqli->query(" INSERT INTO Doctor (doctorID,doctorFName,doctorLname, 
//   idDepartment,specialty) VALUES( null , '$firstname','$lastname',
//   '$idDepart','$special') ") or die($mysqli->error);


    // will show at top of page when user updates the table
    $_SESSION['message'] = "Record has been updated";
    $_SESSION['msg_type'] = "warning";
    header('location: index.php');
    // session_destroy();

}
lets0code
  • 153
  • 3
  • 17
  • 2
    You have `$idDepart = $_POST['idDepartment'];`, but your input is -> ` – Sean Dec 03 '18 at 01:49
  • 1
    Exasperating doesn't help get questions answered. Avoid [SQL injection too](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) – danblack Dec 03 '18 at 01:51
  • so should I change it to this `` in my `index.php` @Sean – lets0code Dec 03 '18 at 01:54
  • can you please explain your answer @Sean. – lets0code Dec 03 '18 at 02:08
  • 2
    What @Sean was saying is that your input will be in `$_POST['departmentID']`, not `$_POST['idDepartment']` – Nick Dec 03 '18 at 02:09
  • Okay after changing to what @Nick said, I am now not able to see the `firstname,lastname, and specialty` anymore. I will pos a picture above – lets0code Dec 03 '18 at 02:21
  • `if(count($result) == 1){` should be `if ($result->num_rows == 1)` – Nick Dec 03 '18 at 02:28
  • THANK YOU @Sean you have saved me so much time. You don't understand how happy I am!!! – lets0code Dec 03 '18 at 02:29
  • Thank you also @Nick. You are an amazing person! – lets0code Dec 03 '18 at 02:29
  • 1
    Also, avoid using single quotes for `PHP` variables that holds integers values when you made the query string. Example: `UPDATE Doctor SET doctorFName = '$firstname', doctorLname = '$lastname', idDepartment = '$idDepart', specialty = '$special' WHERE doctorID = $id` should be replaced by this: `UPDATE Doctor SET doctorFName = '$firstname', doctorLname = '$lastname', idDepartment = $idDepart, specialty = '$special' WHERE doctorID = $id` if the variable `$idDepart` holds an integer. This way, you will avoid the engine to autocast (if enabled) to the correct type. – Shidersz Dec 03 '18 at 02:36

0 Answers0