PHP UPDATE data where there are ID matches - php

Question

I'm passing an id from a URL from the previous page and then try to update database values in the row of that id. I feel like I'm close. I'm able to update the value librarian_fname when I add into the update query the specific id number, but when I try and pass that value through the code, it must not be picking it up because it won't update when I use id = '$id'. Not sure what I'm doing wrong. And I am still learning so forgive me if this isn't perfect.
<?php
$id = $_GET['id'];
echo $id;
?>
<?php
// This function will run within each post array including multi-dimensional arrays
function ExtendedAddslash(&$params)
{
foreach ($params as &$var) {
// check if $var is an array. If yes, it will start another ExtendedAddslash() function to loop to each key inside.
is_array($var) ? ExtendedAddslash($var) : $var=addslashes($var);
unset($var);
}
}
// Initialize ExtendedAddslash() function for every $_POST variable
ExtendedAddslash($_POST);
$librarian_fname = $_POST['librarian_fname'];
$id = $_POST['id'];
?>
<?php
if(isset($_POST['add'])) {
$dbhost = 'localhost';
$dbuser = '';
$dbpass = '';
$conn = mysql_connect($dbhost, $dbuser, $dbpass);
if(! $conn ) {
die('Could not connect: ' . mysql_error());
}
$sql = "UPDATE table SET librarian_fname = '$librarian_fname' WHERE id = '$id'";
mysql_select_db('Events');
$result = mysql_query( $sql, $conn );
if(! $result ) {
die('Could not enter data: ' . mysql_error());
}
mysql_close($conn);
header("Location: search.php");
}
else {
?>
<?php
// define variables and set to empty values
$librarian_fname = $id = "";
if ($_SERVER["REQUEST_METHOD"] == "POST") {
$librarian_fname = test_input($_POST["librarian_fname"]);
$id = test_input($_POST["id"]);
}
function test_input($data) {
$data = trim($data);
$data = stripslashes($data);
$data = htmlspecialchars($data);
return $data;
}
?>
<form method="post" action="<?php echo htmlspecialchars($_SERVER[" PHP_SELF "]);?>">
<legend><b>Appointment Topic</b></legend>
<input type="hidden" name="id" value="<? echo $id; ?>">
<label for="librarian_fname">First Name <em>*</em></label>
<input type="text" name="librarian_fname" size="50" required="no" validateat="onsubmit" message="Please enter your first name."> input name = "add" type = "submit" id = "add" value = "Submit">
</form>
<?php
}
?>

Answer 1

Try this
<form method="post" action="<?php echo htmlspecialchars($_SERVER[" PHP_SELF "]);?>">
<legend><b>Appointment Topic</b></legend>
<input type="hidden" name="id" value="<?php echo $_GET['id']; ?>">
<label for="librarian_fname">First Name <em>*</em></label>
<input type="text" name="librarian_fname" size="50" required="no" validateat="onsubmit" message="Please enter your first name."> <input name = "add" type = "submit" id = "add" value = "Submit">
<input type="reset" name="resetButton" id="resetButton" vvalue="Reset Form" style="margin-right: 20px;" />
</form>

Answer 2

I think one of the issues may be that TABLE is a MySQL reserved word.
https://dev.mysql.com/doc/refman/5.5/en/keywords.html
If we want to use a reserved word as an identifier (e.g. table name) it must be escaped. The normative pattern in MySQL to escape identifiers is to enclose them in single backtick characters, e.g.
UPDATE `table` SET
That works whether the identifier is a reserved word or not. Better would be to use a different name for the table.
Be aware that the code appears to be vulnerable to SQL Injection. Potentially unsafe values incorporated into the text of a SQL statement must be properly escaped (e.g. using mysqli_real_escape_string)
https://xkcd.com/327/
The preferred pattern is to not incorporate values into the SQL text, and instead use a prepared statement with bind placeholders.