[RESOLVED] update not going into database

kevinritt

I'm guessing this is another newbie issue. When I update a row, I get the message that the update was successful but there is no change in the database. Here's the code for the update:

<?php
if (isset ($_POST['editContent']))   {
	require ("connections/dbconn.php");
	$content = $_POST['content'];
	$id = $_POST['id'];
	$sql = "UPDATE pages SET content='$content' WHERE id='$id'";
	$result = $conn->query($sql) or die (mysqli_error());
	if ($result){

header("location:admin.php?message=1");

}

}
?>

and here's the code for the admin page with the text editor:

  <?php
				if(isset ($_GET['message'])){
					echo '<font color="red"><strong>You have successfully updated your page  </strong></font>';
				}
				$page = (isset($_GET['page'])) ? $_GET['page'] : "1";
				$sql = "SELECT id, content FROM pages WHERE id='$page'";
				$result = $conn -> query($sql) or die(mysqli_error());
					if($result) {
					$row = $result->fetch_object();

						echo '<form method="post" action="update.php">';
						echo '<textarea name="content" cols="50" rows="15">';
						echo '<input type="hidden" name="id" value="'. $row->id .'"';
						echo $row->content;
						echo '</textarea>';
						echo '<input type="submit" name="editContent" value="Update page" />';
						echo '</form>';
			}   

	?>

How can I get it to show an error message?

bradgrafelman

Problem looks like a missing '>' for the id INPUT element.

kevinritt wrote:
How can I get it to show an error message?

Well, it's probably not outputting an error message because there is no error with the query. The $_POST['id'] is most likely getting all mangled up due to the error in the HTML, but that apparently doesn't break the query. You could try outputting the query and also checking if any rows were affected by the UPDATE.

EDIT: Also, your code is vulnerable to SQL injection attacks. User-supplied data should never be placed directly into a SQL query string. Instead you must first escape it e.g. with [man]mysqli_real_escape_string/man (or by using prepared statements).

kevinritt

I fixed the closing '>' tag but still no updating

I want to make sure I secure the query - would I do something like this:

$content = mysqli_real_escape_string($_POST['content']);
    $id = mysqli_real_escape_string($_POST['id']);

Weedpacket

bradgrafelman wrote:
Problem looks like a missing '>' for the id INPUT element.

It's also inside the <textarea> element instead of outside.

kevinritt

Fixed the tags but it's still mot working:

  <?php
				if(isset ($_GET['message'])){
					echo '<font color="red"><strong>You have successfully updated your page  </strong></font>';
				}
				$page = (isset($_GET['page'])) ? $_GET['page'] : "1";
				$sql = "SELECT id, content FROM pages WHERE id='$page'";
				$result = $conn -> query($sql) or die(mysqli_error());
					if($result) {
					$row = $result->fetch_object();

						echo '<form method="post" action="update.php">';
						echo '<input type="hidden" name="id" value="'. $row->id .'">';
						echo '<textarea name="content" cols="50" rows="15">';
						echo $row->content;
						echo '</textarea>';
						echo '<input type="submit" name="editContent" value="Update page" />';
						echo '</form>';
			}   

	?>

bradgrafelman

When you view the page with the form in your browser, what does the HTML look like? Can you copy and paste it here for us?

kevinritt

bradgrafelman;10926043 wrote:
When you view the page with the form in your browser, what does the HTML look like? Can you copy and paste it here for us?

Because I'm using MySQLi I had to write the code like this:

$content = mysqli_real_escape_string($conn,$_POST['content']);
    $id = mysqli_real_escape_string($conn,$_POST['id']);

It works now - I'll mark as solved