/    Sign up×
Community /Pin to ProfileBookmark

Problem UPDATE Table in mysql Works No errros But Not updating!

HI Guys , I appreciate if somebody could tell what mistakes do i have in the following code :
[B]Contents Table[/B]

[code=php]<?php

// Set Mysql Connection info
$host =”localhost”;
$username=”root”;
$password=””;
$db_name=”mail”;
$table_name=”emails”;

// Connect to database
mysql_connect(“$host”, “$username”, “$password”)or die(mysql_error());
mysql_select_db(“$db_name”) or die(“Couldn’t find mysql database”);

$sql = “SELECT * FROM $table_name ORDER BY id” or die(mysql_error());
$result = mysql_query($sql); ?>
<table width=”50%” border=”1″>
<tr>
<td width=”25%” bgcolor=”#cccccc”> ID </td> <td width=”25%”> Name </td> <td width=”50%”>Email</td>
</tr>
<?php while($rows=mysql_fetch_array($result))
{ ?>

<tr>
<td width=”25%” bgcolor=”#cccccc”><?php echo $rows[‘id’];?></td>
<td width=”25%”><?php echo $rows[‘name’]; ?></td>
<td width=”50%”><?php echo $rows[’email’]; ?></td>
<td width=”50%”><a href=edit.php?id=<?php echo $rows[‘id’];?>>Edit</a></td>
</tr>

<?php
}

mysql_close

?>
</table>[/code]

[B]Edit Form[/B]

[code=php]<?php

// Set Mysql Connection info
$host =”localhost”;
$username=”root”;
$password=””;
$db_name=”mail”;
$table_name=”emails”;

// Connect to database
mysql_connect(“$host”, “$username”, “$password”)or die(mysql_error());
mysql_select_db(“$db_name”) or die(“Couldn’t find mysql database”);

// get the value id
$id = $_GET[‘id’];

// get data from mysql database

$sql= ” SELECT * FROM $table_name WHERE id=’$id’ “;
$result = mysql_query($sql);
$rows = mysql_fetch_array($result);

?>

<form name=”update” method=”post” action=”update.php”>
<p>Name: <br />
<input type=”text” name=”name” id=”name” value=”<?php echo $rows[‘name’];?>” /> </p>
<p>E-mail:<br />
<input type=”text” name=”email” id=”email” value=”<?php echo $rows[’email’];?>” />
<br />
<input name=”id” type=”hidden” value=”<?php echo $rows[‘id’];?>”/>
<input type =”submit” name=”submit” value=”submit” />
</form>
<?php
// close connection
mysql_close();

?>
[/code]

[B]The file That Update Table in mysql[/B]

[code=php]<?php

// Set Mysql Connection info
$host =”localhost”;
$username=”root”;
$password=””;
$db_name=”mail”;
$table_name=”emails”;

// Connect to server and select database.
mysql_connect(“$host”, “$username”, “$password”)or die(“cannot connect”);
mysql_select_db(“$db_name”)or die(“cannot select DB”);

// update data in mysql database
$sql=” UPDATE $table_name SET name=’$name’, email=’$email’ WHERE id=’$id'”;
$result=mysql_query($sql);

// if successfull
if($result) {
echo “Subscriber Updated Successfully!”;
}
else { echo “ERROR”;

}
?>[/code]

when i hit submit to update info , it says Updated Successfully , No erros , but actually Nothing updated!

Thank you in advance

to post a comment
PHP

16 Comments(s)

Copy linkTweet thisAlerts:
@NogDogMar 06.2010 — For debugging, at the end where you check the result, try something like this:
[code=php]
// if successfull
if($result) {
if(mysql_affected_rows($result))
{
echo mysql_affected_rows($result) . " rows updated";
}
else
{
echo "No rows updated: <br />n" . htmlspecialchars($sql);
}
}
else {
echo "ERROR";
}
[/code]
Copy linkTweet thisAlerts:
@amaroksauthorMar 06.2010 — For debugging, at the end where you check the result, try something like this:
[code=php]
// if successfull
if($result) {
if(mysql_affected_rows($result))
{
echo mysql_affected_rows($result) . " rows updated";
}
else
{
echo "No rows updated: <br />n" . htmlspecialchars($sql);
}
}
else {
echo "ERROR";
}
[/code]
[/QUOTE]


[B][B]Hi Nogdog I Have Made that and here is what i got :[/B][/B]
[code=php]Warning: mysql_affected_rows() expects parameter 1 to be resource, boolean given in C:xampphtdocsnewsletterupdate.php on line 20
No rows updated:
UPDATE emails SET name='', email='' WHERE id= '' [/code]

I still don't get the error....

Thank you
Copy linkTweet thisAlerts:
@MindzaiMar 06.2010 — I'm confused about the warning, don't see how that's happening if you copied NogDog's example code exactly, but as the printed query shows you the where clause is looking to update rows with an id of '' (of which I assume there are none). You need to set the $id variable to point to a valid id (in fact you need to set all of the data variables). I really hope this code isn't relying on register_globals being on...
Copy linkTweet thisAlerts:
@amaroksauthorMar 06.2010 — I'm confused about the warning, don't see how that's happening if you copied NogDog's example code exactly, but as the printed query shows you the where clause is looking to update rows with an id of '' (of which I assume there are none). You need to set the $id variable to point to a valid id (in fact you need to set all of the data variables). I really hope this code isn't relying on register_globals being on...[/QUOTE]
There are Data already stored in mysql , and when i click on edit beside on of the rows in show.php file it takes me to edit.php then it put the correct variables as input values
Copy linkTweet thisAlerts:
@MindzaiMar 06.2010 — Yes but your update script is not getting those values. How are you passing them to the upload script?

Also, (I seem to constantly post this and it is almost always ignored!) your code is open to SQL injection attacks - you should be cleaning all user input.
Copy linkTweet thisAlerts:
@amaroksauthorMar 06.2010 — Yes but your update script is not getting those values. How are you passing them to the upload script?

Also, (I seem to constantly post this and it is almost always ignored!) your code is open to SQL injection attacks - you should be cleaning all user input.[/QUOTE]


in edit.php shows how i'm passing them , please have a look at the code above

thank you!
Copy linkTweet thisAlerts:
@MindzaiMar 06.2010 — Yes I see that you are sending via POST, my point is that I don't see where the variables used in the query ($name, $email, $id) are being set. Are you relying on register_globals to populate those values, or is there more code which you have not posted?
Copy linkTweet thisAlerts:
@amaroksauthorMar 06.2010 — Yes I see that you are sending via POST, my point is that I don't see where the variables used in the query ($name, $email, $id) are being set. Are you relying on register_globals to populate those values, or is there more code which you have not posted?[/QUOTE]

There are another files , one that Add the name and email to database wich has the 2 variables also $name and $email
Copy linkTweet thisAlerts:
@amaroksauthorMar 06.2010 — I wasn't relying on Register_global Now i Turned it on and everything Seems to be ok , Thank you MindZai and Nogdog!
Copy linkTweet thisAlerts:
@MindzaiMar 06.2010 — Turning it on is a very bad idea. It explains why your script wasn't working but it is a *very* bad "fix" (and I hesitate to even call it that). If you have turned it on your database can now be manipulated by anyone just by typing certain urls into your browser. Not good at all.
Copy linkTweet thisAlerts:
@NogDogMar 06.2010 — Turning it on is a very bad idea. It explains why your script wasn't working but it is a *very* bad "fix" (and I hesitate to even call it that). If you have turned it on your database can now be manipulated by anyone just by typing certain urls into your browser. Not good at all.[/QUOTE]

Well, in and of itself register_globals does not necessarily make it easier for someone to hack the page, depending on how you code it. If you use $_POST['id'] instead of $id but do not sanitize [i]either[/i] one, then your susceptibility is roughly equal, whereas if you do sanitize them and are careful to initialize all other variables you use that are not from external sources, then it also does not matter. But, when register_globals is enabled, the possibility exists that you could write some sloppy code that uses an uninitialized variable which is not intended to contain user-supplied data but which could be converted to such by a GET | POST | COOKIE value submitted by a malicious user. So, long story short, having register_globals turned on does not automatically make any page a security risk, but it does add a possible hole for the unwary/uneducated/lazy programmer; so I agree that it should be turned off and the code fixed to not rely on it. One way is to simply use extract with the optional 2nd parameter to not overwrite existing variables:

[code=php]
<?php
extract($_POST, EXTR_SKIP);
extract($_GET, EXTR_SKIP);
extract($_COOKIE, EXTR_SKIP);
[/code]
Copy linkTweet thisAlerts:
@Jarrod1937Mar 07.2010 — I agree with nogdog, as long as you're careful using register globals is not a big deal... however with that said i wouldn't rely on register globals if you don't need it. Amaroks, i'd suggest properly requesting the values through post using $_POST['name'] and sanitize the values, then using them for the update script.

And as said, please always sanitize user input, even your own! With your script above, i can very easily do some serious damage to your database and/or get hidden info.
Copy linkTweet thisAlerts:
@MindzaiMar 07.2010 — Well, in and of itself register_globals does not necessarily make it easier for someone to hack the page[/QUOTE]

No I realise that, but if you look at this script it is directly using uninitialised variables in a SQL query. With register_globals off the script will fail, now the OP has turned it on they have opened the script up to SQL injection attacks. That's why I suggest that it is not a good solution.
Copy linkTweet thisAlerts:
@phoenixbytesMar 08.2010 — i'd suggest turning them off and setting each variable as global manually and then calling them up again the same way closer to the actual query.

so

[code=php]

$variable_one = $GLOBALS["variable_one"];

//// do other gear, functions and such like, maybe a different file altogether so long as it's inc'd


/// then pull it back up
$bwmode = $GLOBALS["bwmode"];

// and turn register globals OFF.

// and protect your mysql queries whilst your already in the file
[/code]
Copy linkTweet thisAlerts:
@MindzaiMar 08.2010 — There's no need to use globals at all, just access the $_GET superglobal directly, and remember to clean any values before using them.
Copy linkTweet thisAlerts:
@phoenixbytesMar 08.2010 — he's using post method though, so use $_POST["var"]; instead
×

Success!

Help @amaroks spread the word by sharing this article on Twitter...

Tweet This
Sign in
Forgot password?
Sign in with TwitchSign in with GithubCreate Account
about: ({
version: 0.1.9 BETA 5.27,
whats_new: community page,
up_next: more Davinci•003 tasks,
coming_soon: events calendar,
social: @webDeveloperHQ
});

legal: ({
terms: of use,
privacy: policy
});
changelog: (
version: 0.1.9,
notes: added community page

version: 0.1.8,
notes: added Davinci•003

version: 0.1.7,
notes: upvote answers to bounties

version: 0.1.6,
notes: article editor refresh
)...
recent_tips: (
tipper: @AriseFacilitySolutions09,
tipped: article
amount: 1000 SATS,

tipper: @Yussuf4331,
tipped: article
amount: 1000 SATS,

tipper: @darkwebsites540,
tipped: article
amount: 10 SATS,
)...