PHP MYSQL and updating data in a table - php

Question

Good day, all!
I am trying to figure out how to get this chunk of code to do what I want but it eludes me.
What this script is supposed to do is to look through a database of consignment items, pick out the ones that have sold='n' and list them by item number. It displays all of the items in a list with a "Sell" link at the end of each item row. Once the Buyer Number and Amount are entered, the Sell link is clicked, the UPDATE updates the item and changes sold from 'n' to 'y' and once that happens, the item disappears from the list. It works exactly as I expect, except for one little issue that has eluded me. Each time the page is loaded, it doesn't change the amount and buyernumber, but it does change the sold from 'n' to 'y' for the first item only and after that it works as expected, adding the buyernumber and amount to all subsequent items. Until you browse away from it and then it won't do the first item correctly the next time you come back to the page. I have tried all kinds of things to make it work and this is the closest I have to what I want. Any help would be appreciated!
<?php
/**
* Sell an Item
*/
require "../config.php";
require "../common.php";
$success = null;
if (isset($_POST["submit"])) {
if (!hash_equals($_SESSION['csrf'], $_POST['csrf'])) die();
try {
$connection = new PDO($dsn, $username, $password, $options);
$itemnumber = $_POST["submit"];
$buyernumber = $_POST["buyernumber"];
$amount = $_POST["amount"];
$sql = "UPDATE consignitem SET sold='y', amount='$amount', buyernumber='$buyernumber' WHERE sold='n' AND itemnumber = $itemnumber";
$statement = $connection->prepare($sql);
$statement->bindValue(':itemnumber', $itemnumber);
$statement->bindValue(':buyernumber', $buyernuumber);
$statement->bindValue(':amount', $amount);
$statement->bindValue(':sold', $sold);
$statement->execute();
$success = "Item successfully updated";
} catch(PDOException $error) {
echo $sql . "<br>" . $error->getMessage();
}
}
try {
$connection = new PDO($dsn, $username, $password, $options);
$sql = "SELECT * FROM consignitem WHERE sold='n'";
$statement = $connection->prepare($sql);
$statement->execute();
$result = $statement->fetchAll();
} catch(PDOException $error) {
echo $sql . "<br>" . $error->getMessage();
}
?>
<?php require "templates/header.php"; ?>
<h2>Mark Items as Sold</h2>
<?php if ($success) echo $success; ?>
<style>
table, th, td {
border: 1px solid black;
}
</style>
<form method="post">
<input name="csrf" type="hidden" value="<?php echo escape($_SESSION['csrf']); ?>">
<table>
<thead>
<tr>
<th>Sale Number</th>
<th>Item Number</th>
<th>Lot Number</th>
<th>Category</th>
<th>Item Description</th>
<th>Reserve</th>
<th>Seller Number</th>
<th>Amount</th>
<th>Buyer Number</th>
<th>Sold</th>
<th>Paid</th>
<th>Date</th>
<th>Mark</th>
</tr>
</thead>
<tbody>
<?php foreach ($result as $row) : ?>
<tr>
<td><?php echo escape($row["salenumber"]); ?></td>
<td><?php echo escape($row["itemnumber"]); ?></td>
<td><?php echo escape($row["lotnumber"]); ?></td>
<td><?php echo escape($row["category"]); ?></td>
<td><?php echo escape($row["itemdescription"]); ?></td>
<td><?php echo escape($row["reserve"]); ?></td>
<td><?php echo escape($row["sellernumber"]); ?></td>
<td><?php echo escape($row["amount"]); ?><br><input type="text" name="amount" id="amount" size="8"></td>
<td><?php echo escape($row["buyernumber"]); ?><br><input type="text" name="buyernumber" id="buyernumber" size="12"></td>
<td><?php echo escape($row["sold"]); ?></td>
<td><?php echo escape($row["paid"]); ?></td>
<td><?php echo escape($row["date"]); ?> </td>
<td><button type="submit" name="submit" value="<?php echo escape($row["itemnumber"]); ?>">Sell</button></td>
</tr>
<?php endforeach; ?>
</tbody>
</table>
</form>
<br>
<?php require "templates/footer.php"; ?>

Answer 1

You're repeating the same input names in all thr rows of the form. When the form is submitted, the $_POST variables will just contain the value from the last row of the form, not the row that the user clicked the submit button for.
You can give the inputs array-style names that are indexed by itemnumber. $_POST['buyernumber'] and $_POST['amount'] will then be arrays, and you can use $_POST['submit'] to get the appropriate array index.
You also need to use placeholders in the SQL that match the placeholders in bindValue(), rather than substituting the variables directly in the query.
<?php
if (isset($_POST["submit"])) {
if (!hash_equals($_SESSION['csrf'], $_POST['csrf'])) die();
try {
$connection = new PDO($dsn, $username, $password, $options);
$itemnumber = $_POST["submit"];
$buyernumber = $_POST["buyernumber"][$itemnumber];
$amount = $_POST["amount"][$itemnumber];
$sql = "UPDATE consignitem SET sold='y', amount= :amount, buyernumber= :buyernumber WHERE sold='n' AND itemnumber = :itemnumber";
$statement = $connection->prepare($sql);
$statement->bindValue(':itemnumber', $itemnumber);
$statement->bindValue(':buyernumber', $buyernuumber);
$statement->bindValue(':amount', $amount);
$statement->execute();
$success = "Item successfully updated";
} catch(PDOException $error) {
echo $sql . "<br>" . $error->getMessage();
}
}
try {
$connection = new PDO($dsn, $username, $password, $options);
$sql = "SELECT * FROM consignitem WHERE sold='n'";
$statement = $connection->prepare($sql);
$statement->execute();
$result = $statement->fetchAll();
} catch(PDOException $error) {
echo $sql . "<br>" . $error->getMessage();
}
?>
<?php require "templates/header.php"; ?>
<h2>Mark Items as Sold</h2>
<?php if ($success) echo $success; ?>
<style>
table, th, td {
border: 1px solid black;
}
</style>
<form method="post">
<input name="csrf" type="hidden" value="<?php echo escape($_SESSION['csrf']); ?>">
<table>
<thead>
<tr>
<th>Sale Number</th>
<th>Item Number</th>
<th>Lot Number</th>
<th>Category</th>
<th>Item Description</th>
<th>Reserve</th>
<th>Seller Number</th>
<th>Amount</th>
<th>Buyer Number</th>
<th>Sold</th>
<th>Paid</th>
<th>Date</th>
<th>Mark</th>
</tr>
</thead>
<tbody>
<?php foreach ($result as $row) : ?>
<tr>
<td><?php echo escape($row["salenumber"]); ?></td>
<td><?php echo escape($row["itemnumber"]); ?></td>
<td><?php echo escape($row["lotnumber"]); ?></td>
<td><?php echo escape($row["category"]); ?></td>
<td><?php echo escape($row["itemdescription"]); ?></td>
<td><?php echo escape($row["reserve"]); ?></td>
<td><?php echo escape($row["sellernumber"]); ?></td>
<td><?php echo escape($row["amount"]); ?><br><input type="text" name="amount[<?php echo escape($row["itemnumber"]); ?>]" size="8"></td>
<td><?php echo escape($row["buyernumber"]); ?><br><input type="text" name="buyernumber[<?php echo escape($row["itemnumber"]); ?>]" size="12"></td>
<td><?php echo escape($row["sold"]); ?></td>
<td><?php echo escape($row["paid"]); ?></td>
<td><?php echo escape($row["date"]); ?> </td>
<td><button type="submit" name="submit" value="<?php echo escape($row["itemnumber"]); ?>">Sell</button></td>
</tr>
<?php endforeach; ?>
</tbody>
</table>
</form>
<br>
<?php require "templates/footer.php"; ?>