Dangerous assumption

[gabriel]

Is it a DANGOROUS assumption in this cass to think that the right record will be updated after the INSERT INTO query has put the new record into the DB and the SELECT query has retrieved the $sid (story id). The way the SELECT and UPDATE queries are layed out, is is remotely possible that the wrong record can be updated if the user submits a post with the same $uid (user id) and the same name of a story that is already in the DB?

$sql = mysql_query("INSERT INTo $dbstory (uid,storyname,description,series,catid,gid,updated,dateint,rated) VALUES (
'$uid',
'$_POST[storyname]',
'$_POST[desc]',
'$_POST[topic]',
'$_POST[category]',
'$_POST[genre]',
'$date',
'$dateint',
'$_POST[rate]')") or die (mysql_error());

$storyloop = "SELECT sid FROM $dbstory WHERE storyname = '$_POST[storyname]' AND uid = '$uid'";
$storyloop1 = mysql_query($storyloop); 
while ($sl = mysql_fetch_array($storyloop1)){
$sid = $sl['sid'];
}
if(isset($_POST['submitstory'])){
$sql = mysql_query("UPDATE $dbstory SET marked = '$sid', cid = '0' WHERE sid = '$sid'");
}else{

$chapterloop = "SELECT * FROM $dbstory WHERE marked = '$_POST[storys]' AND uid = '$uid' order by cid asc";
$chapterloop1 = mysql_query($chapterloop);
while ($getch = mysql_fetch_array($chapterloop1)){
$numch = $getch['cid'];

$chplus = $numch + 1;
$sql = mysql_query("UPDATE $dbstory SET marked = '$_POST[storys]', cid = '$chplus' WHERE sid = '$sid'");
$sql = mysql_query("UPDATE $dbstory SET updated = '$date' WHERE sid = '$_POST[storys]'");

}
}

[leatherback]

Yes. Not just remotely. It is very likely that that will eventually happen.
As long as the records you use are not unique.. Why do you not include the story ID in the form, to query the database with?

[gabriel]

leatherback wrote:

Yes. Not just remotely. It is very likely that that will eventually happen.
As long as the records you use are not unique.. Why do you not include the story ID in the form, to query the database with?

The only problem is, I don't know what the new story ID is going to be. The story ID is a auto-increment value that is inserted with the INSERT query. I need some way to read the story ID that JUST got inserted so I can use that value for the UPDATE queries. You got an idea on how to accompish this?

[leatherback]

OK,

use mysql_insert_id, if I am correct. But ehh.. If you JUST inserted it.. Why the need to update? Sound to me there is some coding logic which can be improved?

J.