Updating table with username php - php

Question

I am currently working on a job claiming system and currently struggling with users being able to claim a piece of available work in my jobs table.
When replacing parts of the update query called by the update button it seems to be the order_id which is not being passed to the query properly from the original query.
I am very new to this so any other comments or direction would be very helpful
<?php
session_start();
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "dbname";
echo "You are currently logged in as " . $_SESSION["login_user"] . ".<br>";
echo "<table style='border: solid 1px black;'>";
echo "<tr><th>Order ID</th><th>Status</th><th>Service</th><th>Document Type</th><th>Word Count</th><th>Other Considerations</th><th>Date Received</th><th>Claim</th></tr>";
class TableRows extends RecursiveIteratorIterator {
function __construct($it) {
parent::__construct($it, self::LEAVES_ONLY);
}
function current() {
return "<td style='width:150px;border:1px solid black;'>" . parent::current(). "</td>";
}
function beginChildren() {
echo "<tr>";
}
function endChildren() {
echo '<td><form id="view_admin" method="post">
<input type="submit" name="username" value="Accept"></td>';
echo "</tr>" . "\n";
}
}
try {
$conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password);
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$stmt = $conn->prepare("SELECT `Order_ID`,`Status`,`Service`,`Document_Type`,`Word_Count`,`Other_Considerations`,`Receive_Date`
FROM `PRW_JOBS` where `staff_username` is null");
$stmt->execute();
// set the resulting array to associative
$result = $stmt->setFetchMode(PDO::FETCH_ASSOC);
foreach(new TableRows(new RecursiveArrayIterator($stmt->fetchAll())) as $k=>$v) {
echo $v;
}
}
catch(PDOException $e) {
echo "Error: " . $e->getMessage();
}
echo "</table>";
if($_POST && isset($_POST['username'])){
$sql = "update `PRW_JOBS` set `staff_username` = :staff_username where `Order_ID`= :Order_ID and `staff_username` is NULL";
$stm = $conn->prepare($sql);
$stm->bindParam(':Order_ID', $result['Order_ID'], PDO::PARAM_INT);
$stm->bindParam(':staff_username', $_SESSION["login_user"], PDO::PARAM_STR);
$stm->execute();
}
$conn = null;
?>

Answer 1

Your problem arises because you're using setFetchMode() in a wrong way. setFetchMode() returns a boolean (true or false), not a $result. fetchAll() returns a $result! So, instead of using this:
$result = $stmt->setFetchMode(PDO::FETCH_ASSOC);
use this:
$assigned = $stmt->setFetchMode(PDO::FETCH_ASSOC);
$result = $stmt->fetchAll();
Then it will work properly.
I'd recommend you to use them like this:
$fetchedData = $selectStatement->fetchAll(PDO::FETCH_ASSOC);
I also recommend you to ALWAYS look into the php.net docs for each function you are using: parameters list, return value and especially which kind of errors/exceptions it throws. Therefore: always use exception handling. As you already did. But for example, a PDO::prepare function can not only throw a 'PDOexception', but it can also return false. This case must also be covered. See this: PDO::prepare (the "Return values" part).
I prepared for you a complete php solution for your question code. I did it to show you how to separate HTML output from php and to show you how to cover ALL data access functionality and the exception handling.
There are four pages: the main page (index.php), the TableRows.php containing your table rows class, a DataAccess.php for data access and a Printer.php with printing function(s).
I recommend you to ALWAYS save a class in its own php page, which has the same name as the class name.
I used functions in those files. But you can, of course, use OOP, e.g classes, instead. For example a Connection class to handle all db connectivity, a Printer class for printing functionality, etc.
Notice how I "relaxed" the html code and the handling of the whole php in one place. You see how slim is the html code now?
And notice that I don't bring functions like fetchAll() around the page. I call all data access functions in one place, I fetch the data and with THIS $fetchedData I can do what I want around the page. It's safe to close a db connection as soon as possible in code.
Nota bene, for development, not for production (!): if you think that you need to see the whole, detailed exceptions instead of your custom exception messages, just replace these:
printData($pdoException->getMessage());
printData($exception->getMessage());
with these:
printData($pdoException);
printData($exception);
Good luck!
Printer.php
<?php
/**
* Print data on screen in a preformatted way.
*
* #param mixed $data Data to print.
* #return void
*/
function printData($data) {
echo '<pre>' . print_r($data, true) . '</pre>';
}
DataAccess.php
<?php
/**
* Create a new db connection.
*
* #param string $dsn Connection DSN.
* #param string $username Username.
* #param string $password Password.
* #param array $options [optional] Driver options.
* #return PDO Db connection.
*/
function createConnection($dsn, $username, $password, $options = array(
PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
PDO::ATTR_EMULATE_PREPARES => false,
PDO::ATTR_PERSISTENT => true,
)) {
$connection = new PDO($dsn, $username, $password);
foreach ($options as $key => $value) {
$connection->setAttribute($key, $value);
}
return $connection;
}
/**
* Close a db connection.
*
* #param PDO $connection Db connection.
* #return void
*/
function closeConnection($connection) {
$connection = NULL;
}
/**
* Get the data type of a binding value.
*
* #param mixed $value Binding value.
* #return mixed Data type of the binding value.
*/
function getInputParameterDataType($value) {
$dataType = PDO::PARAM_STR;
if (is_int($value)) {
$dataType = PDO::PARAM_INT;
} elseif (is_bool($value)) {
$dataType = PDO::PARAM_BOOL;
}
return $dataType;
}
TableRows.php:
<?php
use RecursiveIteratorIterator;
/*
* Table rows class.
*/
/**
* Table rows class.
*
*/
class TableRows extends RecursiveIteratorIterator {
function __construct($iterator) {
parent::__construct($iterator, self::LEAVES_ONLY);
}
function current() {
return "<td style='width:150px;border:1px solid black;'>" . parent::current() . "</td>";
}
function beginChildren() {
echo "<tr>";
}
function endChildren() {
echo '<td>';
echo '<form id="view_admin" method="post">';
echo '<input type="submit" name="username" value="Accept">';
echo '</td>';
echo '</tr>' . '\n';
}
}
index.php:
<?php
include 'TableRows.php';
include 'DataAccess.php';
include 'Printer.php';
session_start();
$servername = 'localhost';
$dbname = 'dbname';
$username = 'username';
$password = 'password';
$loginUser = isset($_SESSION['login_user']) ? $_SESSION['login_user'] : '';
try {
// Create db connection.
$connection = createConnection('mysql:host=' . $servername . ';dbname=' . $dbname, $username, $password);
// Define sql statement.
$sql = 'SELECT
`Order_ID`,`Status`,`Service`,`Document_Type`,
`Word_Count`,`Other_Considerations`,`Receive_Date`
FROM `PRW_JOBS`
WHERE `staff_username` IS NULL';
// Prepare and check sql statement (returns PDO statement).
$selectStatement = $connection->prepare($sql);
if (!$selectStatement) {
throw new Exception('The SQL statement can not be prepared!');
}
// Execute and check PDO statement.
if (!$selectStatement->execute()) {
throw new Exception('The PDO statement can not be executed!');
}
// Fetch all data.
$fetchedData = $selectStatement->fetchAll(PDO::FETCH_ASSOC);
// Get rows collection.
$tableRows = new TableRows(new RecursiveArrayIterator($fetchedData));
// Upon form submission by 'Accept' button.
if (isset($_POST['username'])) {
// Define sql statement.
$sql = 'UPDATE `PRW_JOBS`
SET `staff_username` = :staff_username
WHERE `Order_ID` = :Order_ID AND `staff_username` IS NULL';
// Prepare and check sql statement (returns PDO statement).
$updateStatement = $connection->prepare($sql);
if (!$updateStatement) {
throw new Exception('The SQL statement can not be prepared!');
}
// Bind values to sql statement parameters.
$updateStatement->bindValue(':Order_ID', $fetchedData['Order_ID'], getInputParameterDataType($fetchedData['Order_ID']));
$updateStatement->bindValue(':staff_username', $loginUser, getInputParameterDataType($loginUser));
// Execute and check PDO statement.
if (!$updateStatement->execute()) {
throw new Exception('The PDO statement can not be executed!');
}
}
closeConnection($connection);
} catch (PDOException $pdoException) {
printData($pdoException->getMessage());
exit();
} catch (Exception $exception) {
printData($exception->getMessage());
exit();
}
?>
<span>
You are currently logged in as <?php echo $loginUser; ?>
</span>
<br>
<table style="border: solid 1px black;">
<tr>
<th>Order ID</th>
<th>Status</th>
<th>Service</th>
<th>Document Type</th>
<th>Word Count</th>
<th>Other Considerations</th>
<th>Date Received</th>
<th>Claim</th>
</tr>
<?php
foreach ($tableRows as $row) {
echo $row;
}
?>
</table>