how can i use _GET and _POST? - php

Question

i tried to make my all of code as _GET in php at first. However, i want to include firstname in php. therefore, i just tried to make first name as _GET but it causes Null value. i created firstname as varchar in database. if i click button, i want to update firstname in database. how can i do this step?
it is part of my php
if($row['seatStatus'] == 1)
{
display("<td style='color:blue;'>Available</td></tr><tr>
<td>First Name: <input type='text' name='fname' id='fname'>
</td></tr></table>","\n" );
display("<div><input type='button' value='Booking seat'
onclick='update()'></div>","\n");
i give function update() in onclick. and i made function update() in html
function update() {
var sel = $("#pix option:selected").val();//check the value of sel
var url = "p1.php";//check the path of p.php
$.get(url,{'pix':sel},function(dataFromtheServer) {
$("#result1").html(dataFromtheServer);
});
}
and last one is about query and $_GET in PHP
$fields = $_GET['pix'];
$name = $_GET['fname'];
$sql1 = "UPDATE seat SET seatStatus=0, firstName = '".$name."'
WHERE seat_id = $fields";

Answer 1

In your update function you not get the value of first name then only it showing as null value.
Just get the value of first name:
function update()
{
var sel = $("#pix option:selected").val();
var fistName =$("#fname").val();
var url = "p1.php";
$.get(url,{'pix':sel,'fname':fistName},function(dataFromtheServer)
{
$("#result1").html(dataFromtheServer);
});
}

Answer 2

I think so: you should update this code use [http://api.jquery.com/jQuery.ajax/]:
function update() {
var sel = $("#pix option:selected").val();
var fname = $('#fname').val();
var url = "p1.php";
$.ajax({
url : url,
type : get,
data: { pix:sel, fname: fname },
success : function( response ) {
$("#result1").html(response);
}
});
}
This code is bad :
$sql1 = "UPDATE seat SET seatStatus=0, firstName = '".$name."'
WHERE seat_id = $fields";
Security Warning: This answer is not in line with security best practices. Escaping is inadequate to prevent SQL injection, use prepared statements instead. Use the strategy outlined below at your own risk. (Also, mysql_real_escape_string() was removed in PHP 7.)