Problem with UPDATE in php

Question

What is wrong with my code? I can display text from my database but the update is not working..

index.php

$i=0;
    while ($i < $num) {
    $first=mysql_result($result,$i,"FirstName");
    $last=mysql_result($result,$i,"LastName");
    $age=mysql_result($result,$i,"Age");
    echo "<b>$first $last</b><br>Age: $age<br>";
    $i++;
    }

    $query="SELECT * FROM persons WHERE  personID='$id'";
    $resulta=mysql_query($query);
    $list=mysql_numrows($resulta); 

$i=0;
while ($i < $list) {
$first=mysql_result($resulta,$i,"FirstName");
$last=mysql_result($resulta,$i,"LastName");
$age=mysql_result($resulta,$i,"Age");

++$i;
} 

?>

<form action="update.php">
<input type="hidden" name="ud_id" value="<?php echo "$id"; ?>">
First Name: <input type="text" name="ud_first" value="<?php echo "$first"?>"><br>
Last Name: <input type="text" name="ud_last" value="<?php echo "$last"?>"><br>
Age: <input type="text" name="ud_age" value="<?php echo "$age"?>"><br>
<input type="Submit" value="Update">
</form>

update.php

<?php
include_once('config.php');
$query="UPDATE persons SET FirstName='$ud_first', LastName='$ud_last', Age='$ud_age' WHERE personID='$ud_id'";
mysql_query($query);
?>

You are not doing any error checking when you do the query. Start adding some; also look at the contents of `$query`. See[Reference: What is a perfect code sample using the mysql extension?](http://stackoverflow.com/q/6198104) for how to add error checking — Pekka, Sep 07 '11 at 06:52
Just one important thing: Never run such code on a remote machine! Your code opens vulnerabilities! — markus, Sep 07 '11 at 06:57
thanks for the advice for now i'm practicing the basics in php.. — woninana, Sep 07 '11 at 06:59
mysql_real_escape_string IS the basiscs of php/mysql. http://php.net/manual/en/function.mysql-real-escape-string.php. — markus, Sep 07 '11 at 07:03

score 2 · Answer 1 · answered Sep 07 '11 at 07:11

I thik the problem is http://lt.php.net/manual/en/security.globals.php

so you cant use $ud_id you have to do it as it shoud be with $_POST['ud_id']

HTML:

<form action="update.php" method="post">

PHP:

$ud_id = mysql_real_escape_string($_POST['ud_id']);
...

score 0 · Answer 2 · answered Mar 22 '14 at 06:31

I think the only things you forgot is the fetching of id in your while function, and the getting of that id in which you need to use $_GET in the update.php I hope this gives you a little head start.

for index.php

$i=0;
while ($i < $list) 
{
$id =mysql_result($resulta,$i,"id");
$first=mysql_result($resulta,$i,"FirstName");
$last=mysql_result($resulta,$i,"LastName");
$age=mysql_result($resulta,$i,"Age");

++$i;
}

for update.php

include_once('config.php');

$ud_id = $_GET['id'];
$query="UPDATE persons SET FirstName='$ud_first', LastName='$ud_last', Age='$ud_age' WHERE personID='$ud_id'";

if(!$query)
{
 die('Could not delete data: ' . mysql_error());
}
mysql_close($link);

Problem with UPDATE in php

2 Answers2