updating record from web based form

Shauna

I can't seem to get this code to update the mySQL database... I've searched and searched for the problem, and have even had someone else look at it. Maybe you can help me??

<?
session_start();
$id = $_GET["id"];
$server = "localhost";
$user = "user";
$pass = "pass";
$database = "staff";

$connection = mysql_connect($server, $user, $pass);

mysql_select_db($database, $connection);

if (isset($Submit))
{
$id = $_POST["id"];
$sql = "update employees
set first = '$first',
last = '$last',
department = '$department',
title = '$title',
WHERE id = $id";
$result = mysql_query($sql, $connection);
}

$sql = "SELECT * FROM employees WHERE id = '$id'";

$result = mysql_query($sql, $connection);

while ($row = mysql_fetch_array($result)) {
echo ("<form name=\"form1\" method=\"post\" action=\"index.php?id=");
echo ("$id");
echo ("\">");
echo ("<p><img src=\"");
echo ("photos/");
echo ("$row[photo]");
echo (".jpg\" ");
echo ("width=\"100\" height=\"150\" align=\"left\"><b>");

echo ("First: <input type=\"text\" value=\"");
echo ("$row[first]");
echo ("\" name=\"first\">");

echo ("<br>");

echo ("Last: <input type=\"text\" value=\"");
echo ("$row[last]");
echo ("\" name=\"last\">");

echo ("<br>");

echo ("Department: <input type=\"text\" value=\"");
echo ("$row[department]");
echo ("\" name=\"department\">");

echo ("<br>");

echo ("Title: <input type=\"text\" value=\"");
echo ("$row[position]");
echo ("\" name=\"title\">");

echo ("<br>");

echo ("<br><br><input type=\"submit\" name=\"Submit\" value=\"Submit\"></form>");
}

piersk

Originally posted by Shauna

$sql = "update employees
set first = '$first',
last = '$last',
department = '$department',
title = '$title',
WHERE id = $id";
$result = mysql_query($sql, $connection);
}

In the above query, you have $id, but in the one below you have '$id':

$sql = "SELECT * FROM employees WHERE id = '$id'";

if $id is an integer, then for the second one, you want:

$sql = "SELECT * FROM employees WHERE id = $id";

theslinky

Actually, either '$id' or $id is fine. If you put quotes around it and it is an integer, mysql will treat it as an integer.

I think you problem lies in the part that prints out the variables.

instead of $row[photo], use $row['photo'] ... i.e. put quotes around your key names. The keys are not defined as variables outside the scope of the array, so I think that's why $row[varname] will not work (but $row['varname'] will)

-sridhar

Weedpacket

Originally posted by theslinky
instead of $row[photo], use $row['photo'] ... i.e. put quotes around your key names. The keys are not defined as variables outside the scope of the array, so I think that's why $row[varname] will not work (but $row['varname'] will)

Don't think that's the problem... inside a string the quotes aren't needed (to save chronic escaping, I guess).

I see this:

if (isset($Submit))
{
$id = $_POST["id"];
$sql = "update employees
set first = '$first',
last = '$last',
department = '$department',
title = '$title',
WHERE id = $id";
$result = mysql_query($sql, $connection);
}

(Previously, $id got its value from $_GET[] ... so which is it? But that's incidental...)

Why have I got a nasty feeling that register_globals is turned off? Because $GET and $POST are (both) being used.

That being the case (and it probably is) it should be $POST['title'] instead of $title, $POST['department'] instead of $department, and so forth in. Otherwise, all that's being updated is a load of nulls.

theslinky

weedpacket, are you sure?

Because whenever I use: $row[varname] I get an undefined index error.

But yes, i agree on register_globals... it's funny I didn't notice it because about 2-3 weeks ago when I was answering a whole bunch of questions, about half of them dealt with register_globals!

-sridhar

Shauna

I actually had the $id always using GET for the value, but was told that might be the problem (since the actual form usees POST). So I switched it thinking that would fix the problem.

register_globals is on. I am able to accomplish something similar with other code (that I've tried reproducing)... I think I just have issues programming.

I can't get $_POST['title'] to work. I get a parse error.

Should it be:

    title = $_POST['title'];
    title = $_POST[title],
    title = $_POST[$title];
    title = $_POST['$title'];
    title = $_POST["$title"];

or
title = $_POST[\"$title\"];

Am I even close...?

theslinky

are you using:

title = $_POST['title']

$title = $_POST['title']

You the latter: $title = $_POST['title']

also, how is your form organized? Are you using:

or are you using:

If you use the second one, then ID is also a post variable.

-sridhar

Shauna

Currently, this is what I have (but still getting a parse error):

if (isset($Submit))
{
$id = $POST["id"];
$sql = "update employees
set $first = $POST['first']
$last = $POST['last']
$department = $POST['department']
$title = $_POST['title']
WHERE id = $id";
$result = mysql_query($sql, $connection);
}

$sql = "SELECT * FROM employees WHERE id = '$id'";

$result = mysql_query($sql, $connection);

while ($row = mysql_fetch_array($result)) {
echo ("<form name=\"form1\" method=\"post\" action=\"index.php?id=");
echo ("$id");
echo ("\">");