PHP Array POST UPDATE only affects the last row - php

Question

I'm trying to UPDATE multiple rows of my DB, but it UPDATE only the last row.
I got all DATA from database and fill the SELECT OPTION MULTIPLE:
<select name="numerosdasorte[]" class="form-control" multiple="">
<?php
$consulta = $PDO->query("SELECT * FROM cota1 WHERE status = '0' ORDER BY cota ASC");
while ($linha = $consulta->fetch(PDO::FETCH_ASSOC)) {
?>
<option value="<?php echo $linha['cota']; ?>"><?php echo $linha['cota']; ?></option>
<?php } ?>
</select>
I got these numbers and I put ',' before save data:
$numerosdasorte = '';
foreach ($_POST['numerosdasorte'] as $numeros) {
$numerosdasorte .= ',' . $numeros;
}
$numerosdasorte = ltrim($numerosdasorte, ',');
I INSERT the data on DATABASE. It works like I want:
$sql = "INSERT INTO users SET name = :name, email = :email, password = :password, endereco = :endereco, numero = :numero, bairro = :bairro, cep = :cep, cidade = :cidade, estado = :estado, telefonefixo = :telefonefixo, telefonecelular = :telefonecelular, datadenascimento = :datadenascimento, cpfcnpj = :cpfcnpj, rg = :rg, numerosdasorte = :numerosdasorte";
Now, I got the problem: I need to get the number that was picked in the form to change this status. All the numbers picked, I need to change to '1'. All the numbers picked needs to be unavailable:
$exploded = explode(",", $numerosdasorte);
foreach( $exploded as $key => $value ) {
$query = "UPDATE cota1 SET status = '1' WHERE cota = $value";
$stmt = $PDO->prepare($query);
}
The problem is, the only row affected is the last. If I choice 5 numbers, for example (001, 002, 003, 004 and 005), only the last number (005) will be affected and changed to '1'.
COMPLETE CODE:
<?php
require '../config.a/conexao.php';
$name = $_POST['name'];
$email = $_POST['email'];
$password = md5(uniqid(""));
$endereco = $_POST['endereco'];
$numero = $_POST['numero'];
$bairro = $_POST['bairro'];
$cep = $_POST['cep'];
$cidade = $_POST['cidade'];
$estado = $_POST['estado'];
$telefonefixo = $_POST['telefonefixo'];
$telefonecelular = $_POST['telefonecelular'];
$datadenascimento = $_POST['datadenascimento'];
$cpfcnpj = $_POST['cpfcnpj'];
$rg = $_POST['rg'];
$numerosdasorte = '';
foreach ($_POST['numerosdasorte'] as $numeros) {
$numerosdasorte .= ',' . $numeros;
}
$numerosdasorte = ltrim($numerosdasorte, ',');
$sql = "INSERT INTO users SET name = :name, email = :email, password = :password, endereco = :endereco, numero = :numero, bairro = :bairro, cep = :cep, cidade = :cidade, estado = :estado, telefonefixo = :telefonefixo, telefonecelular = :telefonecelular, datadenascimento = :datadenascimento, cpfcnpj = :cpfcnpj, rg = :rg, numerosdasorte = :numerosdasorte";
$stmt = $PDO->prepare($sql);
$stmt->bindParam(':name', $name);
$stmt->bindParam(':email', $email);
$stmt->bindParam(':password', $password);
$stmt->bindParam(':endereco', $endereco);
$stmt->bindParam(':numero', $numero);
$stmt->bindParam(':bairro', $bairro);
$stmt->bindParam(':cep', $cep);
$stmt->bindParam(':cidade', $cidade);
$stmt->bindParam(':estado', $estado);
$stmt->bindParam(':telefonefixo', $telefonefixo);
$stmt->bindParam(':telefonecelular', $telefonecelular);
$stmt->bindParam(':datadenascimento', $datadenascimento);
$stmt->bindParam(':cpfcnpj', $cpfcnpj);
$stmt->bindParam(':rg', $rg);
$stmt->bindParam(':numerosdasorte', $numerosdasorte);
$exploded = explode(",", $numerosdasorte);
foreach( $exploded as $key => $value ) {
$query = "UPDATE cota1 SET status = '1' WHERE cota = $value";
$stmt = $PDO->prepare($query);
}
$result = $stmt->execute();
if (!$result) {
var_dump($stmt->errorInfo());
} else {
$subjectPrefix = '[Você foi cadastrado na TOP BRASIL]';
$assunto = 'Você foi cadastrado na TOP BRASIL';
$mensagemHTML = '<h3>Parabéns por fazer parte do nosso GRUPO COOPERATIVO!</h3>
<p>Olá <b>' . $name . '</b>, você fez uma ótima escolha! Acompanhe os sorteios e boa sorte! <br> Agora você está habilitado a acompanhar todo o processo por seu PAINEL de cliente. Para acessar, é muito simples: <br> Acesse nosso site (https://topbrasilbr.com.br/painel), digite seu usuário e senha, e pronto! Fique por dentro das novidades! <br><br> Segue seus dados de cadastro:
<p><b>E-mail:</b> ' . $email . ' <br> <b>Senha:</b> ' . $password . '
<p>Para dúvidas, entre em contato conosco, pelo telefone (24) 2252-3196, ou pelo e-mail: contato#topbrasilbr.com.br.
<p>Um grande abraço!
<p><b>Equipe TOP BRASIL</b>
<hr>';
$headers = "MIME-Version: 1.1\r\n";
$headers .= "Content-type: text/html; charset=utf-8\r\n";
$headers .= "From: TOP BRASIL\r\n";
$headers .= 'Cc: contato#topbrasilbr.com.br' . "\r\n";
$headers .= "Return-Path: $email \r\n";
$envio = mail($email, $assunto, $mensagemHTML, $headers);
if ($envio)
echo "<script>alert('Cadastro realizado com sucesso!'); window.top.location.href = 'index.php';</script>";
}
exit;
?>

Answer 1

For your first insert query, you never execute it. No records are being created. For the second, you're preparing a statement over and over again with different values, but you only execute once at the end of it all. One of the primary reasons for using a prepared statement is so that you DO NOT put the user data directly into the SQL, as you are doing.
In addition to all that, your whole script can be shortened considerably.
<?php
require '../config.a/conexao.php';
// I don't know what you're doing here, but it's not good
$_POST["password"] = md5(uniqid(""));
// here just turn post into your parameters by prefixing key with :
foreach ($_POST as $k=>$v) {
$params[":$k"] = $v;
}
// this is a special case, but the fact that it's here means
// your database structure is no good and needs normalizing
$params[":numerosdasorte"] = implode($_POST["numerosdasorte"], ',');
// prepare the statement
$stmt = $PDO->prepare(
"INSERT INTO users SET name = :name, email = :email, password = :password, endereco = :endereco, numero = :numero, bairro = :bairro, cep = :cep, cidade = :cidade, estado = :estado, telefonefixo = :telefonefixo, telefonecelular = :telefonecelular, datadenascimento = :datadenascimento, cpfcnpj = :cpfcnpj, rg = :rg, numerosdasorte = :numerosdasorte"
);
// no need to bind parameters, just include them as an array in the execution
$result = $stmt->execute($params);
// again, prepare a statement
$stmt = $PDO->prepare("UPDATE cota1 SET status = 1 WHERE cota = ?");
foreach($_POST["numerosdasorte"] as $value ) {
// execute it repeatedly
$stmt->execute([$value]);
}
if (!$result) {
// don't show users this stuff
var_dump($stmt->errorInfo());
} else {
// send your email
}

Answer 2

Try where ... in query for the update. I am assuming that $exploded has an array of numbers like [121, 122, 123];
$exploded = explode(",", $numerosdasorte); // holds only numbers in the array
Then you can do something like this:
$query = "UPDATE cota1 SET status = '1' WHERE cota in ($exploded)"; // it is similar to fire query like "UPDATE cota1 SET status = '1' WHERE cota in (121, 122, 123)"
$stmt = $PDO->prepare($query);
In that case, you don't need the foreach loop as you are passing an array directly for update.
Just a quick reference to help you https://www.w3resource.com/mysql/comparision-functions-and-operators/in-function.php