Unable to update record

Question

I'm new to Php. The following code does not work.
I get no error, the query doesn't work in browser but works in phpmyadmin.

How can I fix it ? Thanks.

include_once("settings.php");
$login = $_SESSION["login"];

$name = $_POST["name"];
$surname = $_POST["surname"];
$email = $_POST["email"];

$query = "use db1; update table1 set name = '$name', surname = '$surname', email = '$email' where column1= '$login'";

$rec = mysqli_query($connection, $query);

if($rec){
    echo "Successful";
}
else{
    echo "Error";
}

"I get no error" - Start to learn debugging: [how-to-get-mysqli-error-information-in-different-environments](https://stackoverflow.com/questions/22662488/how-to-get-mysqli-error-information-in-different-environments) — Paul Spiegel, May 07 '19 at 16:16
Possible duplicate of [How to get MySQLi error information in different environments](https://stackoverflow.com/questions/22662488/how-to-get-mysqli-error-information-in-different-environments) — user3783243, May 07 '19 at 16:17
You can't do `use db1;`. That is a second query. You should specify the DB in the connection object. You could use some multi-query function but please don't. That with your SQL injection is huge problem. — user3783243, May 07 '19 at 16:17
You cannot use two statements in one query unless you use [mysqli_multi_query](https://www.php.net/manual/en/mysqli.multi-query.php). Since the first statement is just selecting a database, then drop that part and use [mysqli_select_db](https://www.php.net/manual/en/mysqli.select-db.php) instead — aynber, May 07 '19 at 16:19
@user3783243 how can I prevent sql injesction in this query ? — Bengi Besçeli, Jun 06 '19 at 14:39
@mrbengi See http://php.net/manual/en/mysqli.quickstart.prepared-statements.php — user3783243, Jun 06 '19 at 14:48

NoobDEV-GBL · Accepted Answer · 2019-05-07T16:25:14.983

1

your code is not correct for php, i have made same changes:

include_once("settings.php");
$login = $_SESSION["login"];

$name = $_POST["name"];
$surname = $_POST["surname"];
$email = $_POST["email"];

$query = "update table1 set name = '$name', surname = '$surname', email = '$email' where column1= '$login'";

$rec = mysqli_query($connection, $query);

if($rec){
    echo "Successful";
}
else{
    echo "Error";
}

Test Ex:

<?php
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "myDB";

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
} 

$sql = "UPDATE MyGuests SET lastname='Doe' WHERE id=2";

if ($conn->query($sql) === TRUE) {
    echo "Record updated successfully";
} else {
    echo "Error updating record: " . $conn->error;
}

$conn->close();
?>

edited May 07 '19 at 16:25

answered May 07 '19 at 16:18

NoobDEV-GBL

354
3
20

1

This is not the same code and may function differently. Additionally, this is still open to SQL injections and has no error reporting. – user3783243 May 07 '19 at 16:19
2

Sorry wich changes have you done ? I see the same code – Bengi Besçeli May 07 '19 at 16:20
1

@user3783243 he says on phpmyadmin works, so the problem is "use db1;" the DB to use shoud be configurated in "settings.php", so will work – NoobDEV-GBL May 07 '19 at 16:21
1

@mrbengi just remove the "use db1;" on the query – NoobDEV-GBL May 07 '19 at 16:21
@NoobDEV-GBL It is not the same in phpmyadmin. There are PHP variables. Who knows what any of those contain. If the OP connects to a different DB in there connecter this will execute unexpected behavior. – user3783243 May 07 '19 at 16:25

Unable to update record

1 Answers1