Coding errors in PHP and MYSQL [duplicate] - php

Question

This question already has answers here:
"Notice: Undefined variable", "Notice: Undefined index", "Warning: Undefined array key", and "Notice: Undefined offset" using PHP
(29 answers)
Closed 7 years ago.
I followed a youtube tutorial which teaches you how to create an edit and delete data page for PHP and MYSQL but for some reason why code isn't working. Two error messages showed up:
Notice: Undefined variable: _Get in C:\Users\siaw_\PhpstormProjects\Report Page\modify.php on line 6
Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in C:\Users\siaw_\PhpstormProjects\Report Page\modify.php on line 8
I followed the tutorial exactly the way it is... I have very limited knowledge on PHP & MYSQL so please figure out the error on line 6 and 8?
Here is the code:
<?php
include 'connect.php';
if(!isset($_POST['submit'])) {
$q = "SELECT * FROM people WHERE ID = $_Get[id]";
$result = mysql_query($q);
$person = mysql_fetch_array($result);
}
?>
<h1>You Are Modifying A User</h1>
<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
Name <input type="text" name="inputName" value="<?php echo $person['Name']; ?>" /><br />
Description <input type="text" name="inputDesc" value="<?php echo $person['Description']; ?>" />
<br />
<input type="hidden" name="id" value="<?php echo $_GET['id']; ?>" />
<input type="submit" name="submit" value="Modify" />
</form>
<?php
if(isset($_POST['submit'])) {
$u = "UPDATE people SET `Name`='$_POST[inputName]', `Description`='$_POST[inputDesc]' WHERE ID = $_POST[id]";
mysql_query($u) or die(mysql_error());
echo "User Has Been Modified";
header("Location: index.php");
}
?>
Also here is the youtube link which I used (https://www.youtube.com/watch?v=kc1bppUlqps)

Answer 1

You should bind properly the variables into your query
You should also sanitize your variables before using them into your query by using *_real_escape_string()
I think your page will have an error when the first isset($_POST["submit"]) condition was not met.
Sanitize your variable(s) first:
$id = mysql_real_escape_string((int) $_GET["id"]);
Bind them to your query:
$q = "SELECT * FROM people WHERE ID = '$id'";
Note that mysql_* is already deprecated and you should consider at least the mysqli_*.
But...mysql is deprecated :(
If you are interested with mysqli_*, you can check this:
First, we have to connect to your database (connection.php) using mysqli_*:
$conn = new mysqli("Host", "Username", "Password", "Database"); /* REPLACE NECESSARY DATA */
/* CHECK CONNECTION */
if (mysqli_connect_errno()) {
printf("Connect failed: %s\n", mysqli_connect_error());
exit();
}
Then for your php file where you process the $_GET["id"]:
if(isset($_POST['submit'])) {
$stmt = $con->prepare("SELECT Name, Description FROM people WHERE ID = ?"); /* PREPARE THE QUERY */
$stmt->bind_param("i", $_GET["id"]); /* BIND $_GET["id"] TO YOUR QUERY; i STANDS FOR INTEGER TYPE */
$stmt->execute(); /* EXECUTE YOUR PREPARED QUERY */
$stmt->bind_result($name, $description); /* BIND THE RESULTS TO THESE VARIABLES CORRESPONDINGLY */
$stmt->fetch(); /* FETCH THE RESULTS */
$stmt->close(); /* CLOSE THE PREPARED STATEMENT */
}
/* YOUR HTML CODE HERE */
if(isset($_POST['submit'])) {
$stmt = $con->prepare("UPDATE people SET Name = ?, Description = ? WHERE ID = ?");
$stmt->bind_param("ssi", $_POST["inputName"], $_POST["inputDesc"], $_POST["id"]); /* s STANDS FOR STRING TYPE */
$stmt->execute();
$stmt->close();
echo "User Has Been Modified";
header("Location: index.php");
}

Answer 2

You need to put the $_GET outside, and also your $_GET syntax is incorrect, try to change :
if(!isset($_POST['submit'])) {
$q = "SELECT * FROM people WHERE ID = $_Get[id]";
$result = mysql_query($q);
$person = mysql_fetch_array($result);
}
with this one :
if(!isset($_POST['submit'])) {
$id = $_GET['id'];
$q = "SELECT * FROM people WHERE ID = $id";
$result = mysql_query($q);
$person = mysql_fetch_array($result);
}