Why doesn't my MySQL update query work? - php

Question

I'm making a blog edit page, but my edit page doesn't do anything. Why doesn't my update query work? I'm collecting the data from an old blog and inserting it into my form. And then I'm trying to update it using my update query.
I think this is the code you need:
<?php
include_once('includes/connection.php');
include_once('includes/article.php');
$article = new Article;
if (isset($_POST['title'], $_POST['content'])) {
$title = $_POST['title'];
$content = nl2br($_POST['content']);
if (empty($title) or empty($content)){
$error ='All fields are required!';
} else {
$query = $pdo->prepare("UPDATE articles SET article_title = ?, article_content = ? WHERE id=:id");
$id = $_POST ['id'];
$query->bindValue(1, $title);
$query->bindValue(2 ,$content);
$query->bindValue ('id', $id);
$query->execute();
header('Location: index.php');
}
}
if (isset($_GET['id'])) {
$id = $_GET['id'];
$data = $article->fetch_data($id)
?>
<?php
} else {
header('Location: index.php');
exit();
}
?>
<form action="aanpassen.php" method="post" autocomplete="off">
<input type="" name="id" value="<?php echo $data['article_id']; ?>">
<input class="titleform" type="text" name="title" placeholder="Blog naam" value="<?php echo $data['article_title']; ?>" />
<textarea id="summernote" name="content" rows="15" cols="50">
<?php echo $data['article_content'] ?> </textarea>
<input class="buttonclass" type="submit" value="Aanmaken" /> </form>

Answer 1

You have a "Invalid parameter number: mixed named and positional parameters" error.
Change ? to placeholders, and change to bindValue():
$query = $pdo->prepare("UPDATE articles SET article_title = :title,
article_content = :content WHERE id=:id");
$id = $_POST ['id'];
$query->bindValue('title', $title);
$query->bindValue('content', $content);
$query->bindValue('id', $id);
$query->execute();
Or use only positional parameters.

Answer 2

The form element id was missing a type attribute - probably defaulted to text
Whilst probably not going to cause errors the mixing of placeholder types in the prepared statement is unusual. The id placeholder was missing the colon in the bindValue call - again possibly OK though to my mind it should always be used in named placeholders.
If the prepared statement failed the initial stage there was no logic to test for it.
<?php
$error=false;
include_once('includes/connection.php');
include_once('includes/article.php');
$article = new Article;
if( $_SERVER['REQUEST_METHOD']=='POST' && $pdo ){
if ( isset( $_POST ['id'], $_POST['title'], $_POST['content'] ) ) {
$id = $_POST ['id'];
$title = $_POST['title'];
$content = nl2br( $_POST['content'] );
if ( empty( $title ) or empty( $content ) or empty( $id ) ){
$error='All fields are required!';
} else {
$query = $pdo->prepare("UPDATE articles SET article_title = :title, article_content = :content WHERE id=:id");
if( $query ){
$query->bindValue( ':title', $title );
$query->bindValue( ':content' ,$content );
$query->bindValue( ':id', $id );
$result=$query->execute();
header( sprintf( 'Location: index.php?status=%s', $result ? 'ok' : 'failed' ) );
} else {
exit('bad foo - unable to prepare sql query');
}
}
} else {
exit( sprintf( "<pre>check all required fields are named correctly\n\n%s</pre>", print_r( $_POST, true ) ) );
}
}
if ( isset( $_GET['id'] ) && $article ) {
$id = $_GET['id'];
$data = $article->fetch_data( $id );
} else {
header('Location: index.php');
exit();
}
?>
<form action="aanpassen.php" method="post" autocomplete="off">
<input type="hidden" name="id" value="<?php echo $id; ?>" />
<input type="text" name="title" class="titleform" placeholder="Blog naam" value="<?php echo $data['article_title']; ?>" />
<textarea name="content" id="summernote" rows="15" cols="50"><?php echo $data['article_content'] ?></textarea>
<input type="submit" class="buttonclass" value="Aanmaken" />
</form>
<?php
if( $error )printf('<h1>%s</h1>',$error);
?>