edit form wipes out db fields instead of changing them

[tryin_to_learn]

Hi,

I have an edit form whose fields are supposed to make changes in a corresponding database. Instead of assigning the new variables, it just wipes the fields clean. I've tried it both with and without the block that starts:

$prof_id=$POST['prof_id'];
$f_name=$POST['f_name'];
$mi=$_POST['mi'];

I wasn't sure if I needed that or if the UPDATE does that, but mine's not working either way.

Any ideas about what's wrong? Here's the first part:

			if( isset($_POST['submit']) ){ 

				$prof_id=$_POST['prof_id'];
				$f_name=$_POST['f_name'];
				$mi=$_POST['mi'];
				$l_name=$_POST['l_name'];
				$credentials=$_POST['credentials'];
				$phone=$_POST['phone']; 
				$address=$_POST['address'];
				$city=$_POST['city'];
				$state=$_POST['state'];
				$zip=$_POST['zip'];
				$fax=$_POST['fax']; 
				$email=$_POST['email'];
etc.

Then there's some validation stuff, then here's the SQL:

$sql = "UPDATE professional SET prof_id='$prof_id', f_name='$f_name', mi = '$mi', l_name='$l_name', credentials='$credentials', phone='$phone', address='$address', city='$city', state='$state', zip='$zip', fax='$fax', email='$email' WHERE prof_id='".$_GET['prof_id']."'";

Can anyone see what's happening? And can someone explain about the

$prof_id=$POST['prof_id'];
$f_name=$POST['f_name'];
$mi=$_POST['mi'];

block? Do I need that or not?

[DeadlySin3]

tryin_to_learn wrote:

can someone explain about the

$prof_id=$_POST['prof_id'];
$f_name=$_POST['f_name'];
$mi=$_POST['mi'];

block? Do I need that or not?

if you're going to be updating your db by saying

UPDATE professional SET prof_id='$prof_id', etc...

Then yes, you need that. The reason behind doing this is register_globals. While register_globals = On, all $_POST variables are automatically created, so there's no need to initialize these variables. This poses a security risk, however. That's beyond the scope of my explanation.

As for doing sql updating, I prefer to do it in a slightly different way - it looks a bit rough but it works!

if( isset($_POST['submit']) ) {

$sql = "UPDATE `professional` SET 
 `prof_id` = '".$_POST['prof_id']."',
 `f_name` = '".$_POST['f_name']."',
 `mi` = '".$_POST['mi']."',
 `l_name` = '".$_POST['l_name']."',
 `credentials` = '".$_POST['credentials']."',
 `phone` = '".$_POST['phone']."',
 `address` = '".$_POST['address']."',
 `city` = '".$_POST['city']."',
 `state` = '".$_POST['state']."',
 `zip` = '".$_POST['zip']."',
 `fax` = '".$_POST['fax']."',
 `email` = '".$_POST['email']."'
 WHERE  `prof_id` = '".$_GET['prof_id']."'";

}

Hope this helps ya out.

[Shrike]

DeadlySin3 wrote:

Then yes, you need that. The reason behind doing this is register_globals. While register_globals = On, all $POST variables are automatically created, so there's no need to initialize these variables. This poses a security risk, however. That's beyond the scope of my explanation.

$POST has nothing to do with register_globals, it is always available regardless of that directive. register_globals puts POST, GET and COOKIE variables into the global scope automatically, thus allowing possible malicious injection from the client (the security risk you mentioned).

In addition putting client data directly into an SQL statement is another big security hole. I can't stress enough that any and all data which has not come from your own server should be checked before use. mysql_real_escape_string() is the current preferred function for sanity checks on MySQL.