[RESOLVED] Update query not working

[cybastud]

Hi

My update query does not seem to work. When I updated the data it gives me the message "Your account details have been successfully updated!" but it does not updated the records in the database.

Any assistance will be appreciated

Thanks

<?php
include ('connect.php');//Includes database connection details
error_reporting(0); // turn error messages off
session_start(); // start a session
if(!isset($_SESSION['username'])){ // check if the username is not stored in the session
	    header("location:index.php"); // redirect to index.php page
	}

//Define variable submitted by the form
$Update = $_POST['update'];
$membership_id= $_GET['membership_id']; //catch the form variable $membership_id


$query = "SELECT bank, card, debit FROM membership_info WHERE membership_id = '$membership_id'"; //query to select the data in the membership_info table
$result = mysqli_query($connection,$query);

while($row = mysqli_fetch_array($result)){ //loop part of the query that loops through each row
    $bank = $row['bank'];
	$card = $row['card'];
	$debit = $row['debit'];
}
?>
  </p>

  <form Method="POST" ACTION="edit.php">
<input type="hidden" name="member_id" value="<?php echo "$membership_id"; ?>">
<table border="2" align="center">
<tr>
<td>Bank</td><td><input name="bank" type="text" value="<?php echo "$bank";?>"></input></td>
</tr>
<tr>
<td>Card</td><td><input name="card" type="text" value="<?php echo "$card";?>"></input></td>
</tr>
<tr>
<td>Debit Date</td><td><select name="debit" id="debit" value="<?php echo "$debit";?>">
		  <option selected"selected"><?php echo "$debit";?></option>
          <option>1st</option>
          <option>15th</option>
          <option>20th</option>
          <option>25th</option>
          <option>30th</option>
          <option>Last Day of the Month</option>
        </select>

</tr>
</table> 
<p align="center">
    <input type="submit" name="update" value="Update">

</input>
</p>
</form>

<?php
if (isset($_POST['update'])) { //check if the submit button was click
		$membership_id = $_POST["membership_id"];
		$bank = $_POST["bank"];
		$card = $_POST["card"];
		$debit = $_POST["debit"];

	$sql = "UPDATE membership_info SET bank = '$bank', card = '$card', debit = '$debit' WHERE membership_id = '$membership_id'"; // query to update membership_info table with submitted data
	$result = mysqli_query($connection,$sql);

		if($result){ // check if query was sucessful
		echo "<p align = 'center'>Your account details have been successfully updated!</p>";
		}
		else{
				echo "error";
			}
	}
?>

[bradgrafelman]

Several issues I see just by looking at the code:

1. error_reporting(0); // turn error messages off 

   IMHO, you should always have error_reporting set to E_ALL (perhaps with '& ~E_NOTICE' added onto it, but preferably not). Otherwise, how will you know what the problem is when something isn't working correctly?

2. if(!isset($_SESSION['username'])){ // check if the username is not stored in the session 
           header("location:index.php"); // redirect to index.php page 
       }

   The rest of your script is still going to be executed even if this if() condition is satisfied. You probably will want to [man]exit[/man] after settin the header.

3. $Update = $_POST['update']; 
   $membership_id= $_GET['membership_id']; //catch the form variable $membership_id 

   What happens if either of these two external variables isn't set? (The answer: an E_NOTICE level error message is emitted yet your script carries on obliviously.)

4. User-supplied data should never be placed directly into a SQL query, else your code will be vulnerable to SQL injection attacks and/or just plain errors. See the man page [man]security.database.sql-injection[/man] for more info.

5. You never check to see if your SELECT query is successfully executed before you attempt to fetch its results. Likewise, you also never check to see if it executed successfully but resulted in an empty result set.

6. You have a while() loop that will overwrite the values stored in variables until the last row of the result set is reached. Thus, you'll only ever actually process the last row; why use a loop at all?

7. Try echo'ing out $sql when you execute the UPDATE query; does it look correct? Can you copy-paste it here for us to see? Also try echo'ing out the value returned by [man]mysqli_affected_rows/man after you execute the UPDATE query.

[cybastud]

Thanks for the reply.

If I set my error reporting to error_reporting(E_ALL) I get an Undefined index: update in C:\wamp\www\edit.php on line 159

as well as undefined index for the following: bank, card and debit.

I dont understand this because isn't this defining a variable? $Update = $_POST['update'];

on the previous page i set the external variables as follows:

echo "<a href=edit.php?membership_id=$membership_id&update=yes>Edit</a>";

After putting error_reporting(0)

When I echo out $sql after executing the updated when I change the bank name to Standard Bank I get the following

UPDATE membership_id SET bank = 'Standard Bank', card = '4659', debit = '25th' WHERE membership_id = "

It shows everything as it should except for the membership_id which is blank...any ideas?

[cybastud]

ok found the problem, the name of the input field was set to "member_id" instead of "membership_id"....its working now

Thanks