Help with an edit page to update tables

SeanKann

Ok i have 2 pages here.. An edit page and a send edit page.

Problem i'm having is when i hit adjust(submit) the values goto the next page but do not update the database tables that i have

I think it's my update code that I'm using.. but i'll post both pages

First Page Edit.php

mysql_connect($dbhost,$dbuser,$dbpass) or die("You broke it");
@mysql_select_db("$dbname") or die("You broke the database");

$query="SELECT * from $table";

echo "<center><P><br><br><br><table border='1'>
  <tr><td colspan='7'><center>Edit Existing Members</center></td></tr>
<tr>
<th>ID#</th>
<th>Name</th>
<th>Class</th>
<th>Total DKP</th>
<th>Total DKP Spent</th>
<th>Total DKP Earned</th>
<th>Adjust</th>
</tr>";

$query =  "SELECT *,  total_dkp_earned - total_dkp_spent AS total_dkp FROM $table ORDER BY name Asc";
#$query = "SELECT * FROM $table ORDER BY name Asc";
$result=mysql_query($query);

while($row = mysql_fetch_array($result))
{

echo "<tr>";
echo "<td>"	.$row['id']					.			"</td>";
echo "<td>"	.$row['name']				.			"</td>";
echo "<td>"	.$row['class']				.			"</td>";
echo "<td>"	.$row['total_dkp']			.			"</td>";
echo "<td>"	.$row['total_dkp_spent']	.			"</td>";
echo "<td>"	.$row['total_dkp_earned']	.			"</td>";
echo "<td><form action='edit2.php' method='post'>";
echo "<input type='hidden' name='player_id' value='$row[id]' />";
echo "Add: <input type='text' name='add' value='0' />";
echo "Sub: <input type='text' name='sub' value='0' />";
echo "<input type='submit' value='Adjust' /></form></td>";
echo "</tr>";

}
echo "</table>";
mysql_close();
?>

Second page sendedit.php

From the first page say in the first row i put in 50 50.

On the sendedit.php page I get values coming over that i put in their just not being updated in the tables at all

error_reporting(E_ALL);

mysql_connect($dbhost,$dbuser,$dbpass) or die("You broke it");
@mysql_select_db("$dbname") or die("You broke the database");

$add=$_POST['add'];
$sub=$_POST['sub'];
$id=$_POST['id'];
$total_dkp_spent=$_POST['total_dkp_spent'];
$total_dkp_earned=$_POST['total_dkp_earned'];

$sqlquery = "UPDATE $table SET ('$total_dkp_spent' = '$sub' + 'total_dkp_spent', '$add' = '$total_dkp_earned' + 'total_dkp_earned'  WHERE 'id' = '$id')";

$results = mysql_query($sqlquery);

mysql_close();
print "It was sent"

Only 2 fields in the tale are being updated $total_dkp_spent and $total_dkp_earned thats it

I know most likely it's something really small but I can't figure it out

vaaaska

Don't you have any kind of security on this?

Do you have any kind of quotes (single or double) from your $_POST vars?

You need to, either way, do something to make your query at the very remote side of things safe...or somewhat safe. Read this...note 'Example #2'...

http://be.php.net/manual/en/function.mysql-real-escape-string.php

SeanKann

The edit area is going to be in a password protected directory. Only 1 person will have access to this file

rincewind456

Have you echoed out the sql query to see if it looks right?

SeanKann

I don't know if their right at all.. i looked it up and someone suggested it.

what has to happen is in the table there will have records(numbers) in the tables

and on the 1 page need to adjust the number by adding to earned and adding to spent.

On the main index page i have it setup to take the earned - spent = total

So for my sql update it has to get the current value in the record then add the new total to it.

So say i had a record of this

Spent Earned Total
100 250 150

Then had to adjust they earned another 250 spent another 100

Spent Earned Total
100+100 250+250 300

rincewind456

The only $POST Values that are being sent from the edit page are $POST['add'], $POST['sub'] and $POST['player_id'], so I have no idea where you think you're getting $POST['total_dkp_spent'] and $POST['total_dkp_earned'] from , and $id is not being passed by $POST['id'] but by $POST['player_id'].

Also $table is not defined anywhere in either of the pages.

If you want to update the table you would do it something like this

UPDATE $table 
SET total_dkp_spent = total_dkp_spent + $sub,
total_dkp_earned = total_dkp_earned + $add
 WHERE id = $player_id

SeanKann

I have the $table up where i have the $dbhost $dbuser etc is

here is my msql table and what it looks like

CREATE TABLE dkp_index (
id int(6) NOT NULL auto_increment,
name varchar(25) NOT NULL default '',
class varchar(12) NOT NULL default '',
total_dkp int(8) NOT NULL default '0',
total_dkp_spent int(8) NOT NULL default '0',
total_dkp_earned int(8) NOT NULL default '0',
PRIMARY KEY (id)
) ENGINE=InnoDB AUTO_INCREMENT=4 DEFAULT CHARSET=latin1 AUTO_INCREMENT=4 ;