Data is not updated into database [closed] - php

Question

Closed. This question is not reproducible or was caused by typos. It is not currently accepting answers.
This question was caused by a typo or a problem that can no longer be reproduced. While similar questions may be on-topic here, this one was resolved in a way less likely to help future readers.
Closed 3 years ago.
Improve this question
I have a form that I use to insert data into database and a table in which I display the records from the same database. I have the update button on each record displayed.
When I click on it, the data from the database is displayed in each input from the form; I've modified the information that I want and click Update button from the form.
The problem is that the data I have modified is not updated in the database and is not displayed in the table of my page.
My index-admin.php file:
<?php
include("functions.php");
//fetch record to be updates
if(isset($_GET['update'])){
$id = $_GET['update'];
$update = true;
$query="SELECT * FROM utilizatori WHERE id_user= $id";
$record = mysqli_query($conn,$query);
if (count($record) == 1 ) {
$rec = mysqli_fetch_array($record);
$id=$rec['id_user'];
$nume=$rec['nume'];
$prenume=$rec['prenume'];
$email=$rec['email'];
$pwd=$rec['pass'];
$rol=$rec['rol'];
}
}
?>
My form:
<form method="POST" action="functions.php">
<input type="hidden" name="id" value="<?php echo $id; ?> ">
<div class="input-group">
<label>Nume</label>
<input type="text" name="nume" value="<?php echo $nume; ?>">
</div>
<div class="input-group">
<label>Prenume</label>
<input type="text" name="prenume" value="<?php echo $prenume; ?>" >
</div>
<div class="input-group">
<label>Email</label>
<input type="text" name="email" value="<?php echo $email; ?> ">
</div>
<div class="input-group">
<label>Password</label>
<input type="text" name="pass" value="<?php echo $pwd; ?> ">
</div>
<div class="input-group">
<label>Rol</label>
<input type="text" name="rol" value="<?php echo $rol; ?> " >
</div>
<div class="input-group">
<?php if ($update == false): ?>
<button type="submit" name="save" class="btn">Save</button>
<?php else: ?>
<button type="submit" name="update" class="btn">Update</button>
<?php endif ?>
</div>
</form>
My functions.php file:
if(isset($_POST['update'])) {
$nume = mysqli_real_escape_string($conn,$_POST['nume']);
$prenume = mysqli_real_escape_string($conn,$_POST['prenume']);
$email = mysqli_real_escape_string($conn, $_POST['email']);
$pwd = mysqli_real_escape_string($conn, $_POST['pass']);
$rol = mysqli_real_escape_string($conn, $_POST['rol']);
$query="UPDATE utilizatori
SET nume='$nume',
prenume='$prenume',
email='$email',
pass='$pwd',
rol='$rol'
WHERE id_user=$id;";
mysqli_query($conn,$query);
$_SESSION['msg'] = 'Date actualizate!';
header('Location:index-admin.php');
}

Answer 1

It seems that $id is undefined within functions.php. It only existed in index-admin.php, and when the form is submitted, that code is not running. Web applications are stateless and variable values do not persist between requests. Nor are variable values magically passed between separate script files (unless they are called within the same request via an "include" or "require" statement).
However you've actually partially solved that. You have already placed the ID within a hidden field in your form when index-admin is being loaded. Now you just need to create a new variable to read it in functions.php:
if(isset($_POST['update'])) {
$id = $_POST["id"];
As a separate point, I can't see why you also wrote include("functions.php"); within the index-admin script...your form posts back directly to functions.php, rather than to index-admin.php. It makes no sense to include functions.php within that page...it won't do anything useful as far as I can see.
Please pay attention to the warnings within the comments about SQL Injection. This is a serious vulnerability and you should fix it as soon as possible, preferably before you commence testing your code (so that you don't have to re-test it once you've re-written the query code).