I don't have to worry about malicious users but point taken about entry using quotes.
You may not have to worry about them now, but worrying about them now means that you will not forget to worry about them later when it matters.
looks like this is goig to be a bad starting point.
We could still use it though. I would simplify the example such that the database table becomes:
CREATE TABLE `test_people` (
`id` INT NOT NULL AUTO_INCREMENT,
`name` VARCHAR(65) NOT NULL DEFAULT '',
PRIMARY KEY(`id`)
);
Then to insert the test data:
INSERT INTO `test_people` (`name`) VALUES ('Billly'), ('Jame'), ('Mark'), ('Linda'), ('Joey'), ('Sidney');
A simple PHP form to process and display the names of the people:
<?php
$host = "localhost"; // Host name
$username = ""; // Mysql username
$password = ""; // Mysql password
$db_name = "test"; // Database name
$tbl_name = "test_people"; // Table name
// Connect to server and select databse.
$db = new PDO('mysql:host=' . $host . ';dbname=' . $db_name, $username, $password);
// If there is an update, process it.
if (isset($_POST['submit'], $_POST['name']) && is_array($_POST['name'])) {
$stmt = $db->prepare("UPDATE `$tbl_name` SET `name`=:name WHERE id=:id");
$stmt->bindParam(':id', $id, PDO::PARAM_INT);
$stmt->bindParam(':name', $name, PDO::PARAM_STR);
foreach ($_POST['name'] as $id => $name) {
$stmt->execute();
}
echo '<h1>Updated the records.</h1>';
}
// Print the form.
echo '<form action="' . htmlspecialchars($_SERVER['PHP_SELF']) . '" method="post">';
foreach ($db->query("SELECT `id`, `name` FROM `$tbl_name` ORDER BY `name`") as $row) {
echo '<input type="text" name="name[' . (int)$row['id'] . ']" value="'
. htmlspecialchars($row['name']) . '" /><br />';
}
echo '<input type="submit" name="submit" value="Update" /></form>';
?>
I have chosen to use the PDO extension in my example instead of the MySQL extension.
