0

I have a MySQL db, and I want to update one of its tables named fastfoods. On the side I have an android application to send and receive data to/from my db. It seems there is a problem in my api or android code, which does not let my table get updated.

I have already check if the primary key has a valid value when I send it to the api.

here is my api:

<?php

$fastfoodJson = file_get_contents('php://input');
$fastfoodArray =json_decode($fastfoodJson, true);
$data = [];

// 1. Data Filtering (Validation)
$id = $fastfoodArray["id"];
$name = $fastfoodArray["name"];
$country = $fastfoodArray["country"];
$city = $fastfoodArray["city"];
$address = $fastfoodArray["address"];
$tel = $fastfoodArray["tel"];
$type=$fastfoodArray["type"];
$description=$fastfoodArray["description"];
$latitude=$fastfoodArray["latitude"];
$longitude=$fastfoodArray["longitude"];


// 2. Connect To Mysql and select your desired DB
$connection = mysqli_connect('localhost', 'root', '', 'where_to_eat');
if(!$connection){
    $data["status"] = "Connection Failed";
}else{
// 3. Perform Your Query   
    $query= "UPDATE `fastfoods` SET `name` = '$name' , `country` = '$country' , `city` = '$city' , `address` = '$address' , `tel` = '$tel' , `type` = '$type' , `description` = '$description' , `latitude` = '$latitude' , `longitude` = '$longitude' WHERE `id` = '$id'";


    $result = mysqli_query($connection, $query);
    if(!$result)
        $data["status"] = "Query Not Executed";
    else{
// 4. Report the results to the user
        $affectedRows = mysqli_affected_rows($connection);
        $data["status"] = $affectedRows . " fastfood updated successfully...";
    }

// 5. Close the connection
    mysqli_close($connection);
}

echo json_encode($data);

here is my Async class (doInBackground) to send data through api:

protected String doInBackground(String... strings) {
            InputStream inputStream = null;
            String result = "";
            try {

                JSONObject jsonObj = new JSONObject();
                jsonObj.put("name", strings[1]);
                jsonObj.put("country", strings[2]);
                jsonObj.put("city", strings[3]);
                jsonObj.put("address", strings[4]);
                jsonObj.put("tel", strings[5]);
                jsonObj.put("type", strings[6]);
                jsonObj.put("description", strings[7]);
                jsonObj.put("latitude", strings[8]);
                jsonObj.put("longitude", strings[9]);
                jsonObj.put("id",strings[10]);

                URL url = new URL(strings[0]);
                HttpURLConnection connection = (HttpURLConnection) url.openConnection();
                connection.setRequestMethod("POST");
                connection.setRequestProperty("Content-type", "application/json");
                connection.setRequestProperty("Accept", "application/json");

                connection.setDoInput(true);
                connection.setDoOutput(true);
                connection.setConnectTimeout(10000);
                connection.setReadTimeout(10000);

                connection.connect();

                OutputStream out = connection.getOutputStream();
                DataOutputStream dos = new DataOutputStream(out);
                dos.writeBytes(jsonObj.toString());

                dos.flush();
                dos.close();

                inputStream = connection.getInputStream();
                BufferedReader buffer = new BufferedReader(new InputStreamReader(inputStream));

                String str = "";
                while((str = buffer.readLine()) != null)
                    result += str;

                return result;

            } catch (MalformedURLException e) {
                return e.toString();
            } catch (IOException e) {
                return e.toString();
            } catch (JSONException e) {
                e.printStackTrace();
                return e.toString();
            }

and here is how I call the Async class:

        new     UpdateFastfoodAsync().execute("http://10.0.2.2:80/whereToEatAPI/api/update_fast    food_api.php"
                            ,name.getText().toString()
                            ,country.getText().toString()
                            ,city.getText().toString()
                            ,address.getText().toString()
                            ,tel.getText().toString()
                            ,"Table"
                            ,description.getText().toString()
                            ,latitude.getText().toString()
                            ,longitude.getText().toString()
                            ,fid_);

And this is how I call Async class:

    new UpdateFastfoodAsync().execute("http://10.0.2.2:80/whereToEatAPI/api/update_fastfood_api.php"
                            ,name.getText().toString()
                            ,country.getText().toString()
                            ,city.getText().toString()
                            ,address.getText().toString()
                            ,tel.getText().toString()
                            ,"Table"
                            ,description.getText().toString()
                            ,latitude.getText().toString()
                            ,longitude.getText().toString()
                            ,fid_);
Dharman
  • 30,962
  • 25
  • 85
  • 135
Yasi.Aap
  • 3
  • 3
  • 3
    You are wide open for SQL injection. Since you're using mysqli, take advantage of [prepared statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) and [bind_param](http://php.net/manual/en/mysqli-stmt.bind-param.php). **This will take care of any pesky quoting issues that may occur.** If it's getting to the query and returning `Query Not Executed`, then you need to check for [mysqli errors](http://php.net/manual/en/mysqli.error.php) and return that information, so you know exactly why it failed. – aynber Jun 27 '19 at 18:50
  • What debugging have you done? Did switching to prepared statements solve your problem already or is it still not working? [How to get the error message in MySQLi?](https://stackoverflow.com/a/22662582/1839439) – Dharman Jun 27 '19 at 20:27

0 Answers0