[RESOLVED] trouble with updating mysql table

[fandhie]

I made two php files to edit data on a table of my database.

the table's structure is following :
id_kategori (INT) auto increment
nama_kategori (VARCHAR)
keterangan /B

the first script/php file to edit data:

<?php
include "../config/connection.php";

$edit=mysql_query("SELECT * FROM kategori
                  WHERE id_kategori='$_GET[id]'");
$r=mysql_fetch_array($edit);

echo "<h2>Edit User</h2>
<form method=post action=update_kategori.php>
<input type=hidden name=id value='$r[id_kategori]'>
<table>
<tr><td>Kategori</td><td> :
<input type=text name=nama_kategori value='$r[nama_kategori]'>
</td></tr>
<tr><td>Keterangan</td>
<td> : <input type=text name=keterangan value='$r[keterangan]'>
</td></tr>
<tr><td colspan=2><input type=submit value=Update> 
<input type=button value=Batal onclick=sel.history.back()></td></tr>
</table>
</form>";
?>

the second script/php file to update data:

<?php
include "../config/connection.php";
mysql_query("UPDATE kategori SET 

             nama_kategori='$_POST[nama_kategori]',
             keterangan='$_POST[keterangan]'");
header('location:tampil_kategori.php');
?>

the script works but when I edit/updating only one entry, all entries on the whole table change too 🙁

can anyone help me with this issue?

[bradgrafelman]

All of the entries change because that's what you told MySQL to do with that UPDATE statement; UPDATE every record and SET the values to what you tell it. What you're missing is the WHERE clause, so MySQL knows which record(s) you want to update (just like you had in your SELECT statement).

Also note that your code is vulnerable to SQL injection attacks and SQL errors. User-supplied data should never be placed directly into a SQL query. Instead, it must first be sanitized with a function such as [man]mysql_real_escape_string/man.

[fandhie]

thank u brad..
it works well now...

also thanks for your note... :-)