Using PHP to chang order status with button

Question

I'm creating an order system for 3D prints where people can complete a form and it will put their order on a queue. So far I've been able to do that, but I want to add a feature where when I click the "store" link on the order, it changes the value in the 'status' row from 1 (shows on queue) to 0 (doesn't show on queue) and doesn't show up on the queue page. Everything works from my end, it gets the right row ID and it just doesn't change the value in the DB and I'm not sure why. Any suggestions?

Order Page (index.php):

<!DOCTYPE html>
<html>

<head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0, shrink-to-fit=no">
    <title>Order Dashboard</title>
    <link rel="stylesheet" href="assets/bootstrap/css/bootstrap.min.css">
    <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Lato:300,400,700&amp;display=swap">
    <link rel="stylesheet" href="assets/fonts/ionicons.min.css">
    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/pikaday/1.6.1/css/pikaday.min.css">
</head>

<body>
    <nav class="navbar navbar-dark navbar-expand-lg fixed-top bg-white portfolio-navbar gradient">
        <div class="container"><a class="navbar-brand logo" href="#">Idea Factory 3D Print Order System</a><button data-bs-toggle="collapse" class="navbar-toggler" data-bs-target="#navbarNav"><span class="visually-hidden">Toggle navigation</span><span class="navbar-toggler-icon"></span></button>
            <div class="collapse navbar-collapse" id="navbarNav">
                <ul class="navbar-nav ms-auto">
                </ul>
            </div>
        </div>
    </nav> 
    <main class="page projets-page">
        <section class="portfolio-block project-no-images">
            <div class="container">
                <div class="heading">
                    <h2>Current Orders</h2>
                    <button onClick="window.location.reload();">Refresh</button>
                </div>
                <div class="row">
<?php
$servername = "";
$username = "";
$password = "";
$dbname = "";

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}


$sql = "SELECT id, first_name, last_name, file, instructions, student_id, grade FROM printorder WHERE status = 1";
$result = $conn->query($sql);

if ($result->num_rows > 0) {
    // output data of each row
    while($row = $result->fetch_assoc()) {
        echo "<div class='col-md-6 col-lg-4'> <div class='project-card-no-image'><h3>".$row['first_name']." ".$row['last_name']." </h3> <h4>Student ID: ".$row['student_id']." <br> Grade: ".$row['grade']."</h4> <h4>Special Instructions: ".$row['instructions']."</h4><a class='btn btn-outline-primary btn-sm' role='button' href='".$row['file']."'>Files</a><div class='tags'><a href=../functions/store.php?id=".$row['id'].">Store</a></div></div></div>";
    }
} else {
    echo "0 results";
}

$conn->close();
?>
                </div>
            </div>
        </section>
    </main>
    <script src="assets/bootstrap/js/bootstrap.min.js"></script>
    <script src="https://cdnjs.cloudflare.com/ajax/libs/pikaday/1.6.1/pikaday.min.js"></script>
    <script src="assets/js/theme.js"></script>
</body>

</html>

Function that changes the 'status' value from 1 to 0:

<?php
$servername = "";
$username = "";
$password = "";
$dbname = "";

$conn = new mysqli($servername, $username, $password, $dbname);

if ($conn->connect_error) {
    
    die("Connection failed: " . $conn->connect_error);
}
  
    if (isset($_GET['id'])){
        
        $id=$_GET['id'];
  
        $sql = "UPDATE `printorder` SET `status`=0 WHERE `printorder`.`id` = '$id';"; 

        mysqli_query($con,$sql);
    }
  
    header('location: ../index.php');
?>

Any hints on what I'm doing wrong/suggestions on different ways to do this.

Your script is vulnerable to [SQL Injection Attack](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php). Even if [you are escaping variables, its not safe](https://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string])! You should always use [prepared statements and parameterized queries](https://www.php.net/manual/en/mysqli.quickstart.prepared-statements.php) in either the `MYSQLI` or `PDO` instead of concatenating user provided values into the query. — Andrea Olivato, Jun 16 '22 at 01:12
Regarding your specific error, have you tried debugging the `mysqli_query($con,$sql);` query with `$conn->error`? — Andrea Olivato, Jun 16 '22 at 01:13

Using PHP to chang order status with button

0 Answers0