beginner form with "update from" and "remove" buttons - php

Question

I'm a beginner with PHP. I watched a tutorial to create a form which modifies my wamp-created mysql database table. Copied the video at first, but then made my own table from scratch and tried to upgrade it.
My add row works correctly, but the update and remove do not. I think the WHERE clause is not correct, referencing reg_id.
I created a unique primary key, which auto-increments and cannot be modified; this is what I want to reference when changes are made (since it cannot be changed).
if (isset($_POST['update'])){
$UpdateQuery = "UPDATE register SET First_Name='$_POST[first_name]', Last_Name='$_POST[last_name]', Breed='$_POST[breed]', Weight='$_POST[weight]', Age='$_POST[age]', Sex='$_POST[sex]' WHERE '$_POST[reg_id]'='$_POST[reg_id]'";
mysqli_query($con,$UpdateQuery);};
if (isset($_POST['delete'])){
$DeleteQuery = "DELETE FROM register WHERE reg_id='$_POST[reg_id]'";
mysqli_query($con,$DeleteQuery);};
Here is the rest of it where the form is located:
while($record=mysqli_fetch_array($myData)){
echo "<form action=register.php method=post>";
echo "<tr>";
echo "<td>" . $record['reg_id'] . " </td>";
echo "<td>" . "<input type=text name=first_name value=" . $record['First_Name'] . " </td>";
echo "<td>" . "<input type=text name=last_name value=" . $record['Last_Name'] . " </td>";
echo "<td>" . "<input type=text name=breed value=" . $record['Breed'] . " </td>";
echo "<td>" . "<input type=int name=weight value=" . $record['Weight'] . " </td>";
echo "<td>" . "<input type=int name=age value=" . $record['Age'] . " </td>";
echo "<td>" . "<input type=text name=sex value=" . $record['Sex'] . " </td>";
echo "<td>" . "<input type=submit name=update value=update" . " </td>";
echo "<td>" . "<input type=submit name=delete value=delete" . " </td>";
echo "</tr>";
echo "</form>";
}
Please help me fix it.

Answer 1

if (isset($_POST['update'])){
$UpdateQuery = "UPDATE register SET First_Name='".$_POST['first_name']."',Last_Name='".$_POST['last_name']."', Breed='".$_POST['breed']."', Weight='".$_POST['weight']."', Age='".$_POST['age']."', Sex='".$_POST['sex']."' WHERE reg_id ='".$_POST['reg_id']."'";
mysqli_query($con,$UpdateQuery);
};
if (isset($_POST['delete'])){
$DeleteQuery = "DELETE FROM register WHERE reg_id='".$_POST['reg_id']."'";
mysqli_query($con,$DeleteQuery);
};
should be enclosed by ' ,that is optional.add hidden will be more better
echo "<td><input type='hidden' name='reg_id' value='".$record['reg_id']."'></td>";
echo "<td><input type='submit' name='update' value='update'></td>";
echo "<td><input type='submit' name='delete' value='delete'></td>";

Answer 2

You are using $_POST without '.
Try this : {$_POST['first_name']} and replace all $_POST according to this.
So your update query will be like this :
"UPDATE register SET First_Name='{$_POST['first_name']}', Last_Name='{$_POST['last_name']}', Breed='{$_POST['breed']}', Weight='{$_POST['weight']}', Age='{$_POST['age']}', Sex='{$_POST['sex']}' WHERE reg_id='{$_POST['reg_id']}'";
There is no field with name reg_id, so your $_POST['reg_id'] will not work.Also please change your where condition. You are matching same value in where condition.
And your delete query will be :
"DELETE FROM register WHERE reg_id='{$_POST['reg_id']}'";
Your query is open for sql injection. Refer this :How can I prevent SQL injection in PHP?

Answer 3

display page
while($record = mysqli_fetch_array($myData)) {
echo "<table>";
echo "<tr>";
echo "<td>".$record['reg_id']."</td>";
echo "<td>".$record['First_Name']."</td>";
echo "<td>".$record['Last_Name']."</td>";
echo "<td>".$record['Breed']."</td>";
echo "<td>".$record['Weight']."</td>";
echo "<td>".$record['Age']."</td>";
echo "<td>".$record['Sex']."</td>";
echo "<td><a href='edit.php?reg_id=".$record['reg_id']."'>EDIT</a></td>";
echo "<td><a href='delete.php?reg_id=".$record['reg_id']."'>DELETE</a></td>";
echo "</tr>";
echo "</table>";
}
delete.php
<?php
if (isset($_POST['delete'])){
$DeleteQuery = "DELETE FROM `register` WHERE `reg_id`={$_GET['reg_id']}'";
mysqli_query($con,$DeleteQuery);
header("Location: your display page");
};
?>
Edit Form
while($record = mysqli_fetch_array($myData)) {
echo '<form action="edit.php" method="Post">
<input type="text" name="First_Name" value="'.$record['reg_id'].'"/>
<input type="text" name="First_Name" value="'.$record['First_Name'].'"/>
<input type="text" name="Last_Name" value="'.$record['Last_Name'].'"/>
<input type="text" name="Breed" value="'.$record['Breed'].'"/>
<input type="text" name="Weight" value="'.$record['Weight'].'"/>
<input type="text" name="Age" value="'.$record['Age'].'"/>
<input type="text" name="Sex" value="'.$record['Sex'].'"/>
<imput type="submit" value="save" name="submit" />
</form>';
}
edit.php
if (isset($_POST['update'])){
$UpdateQuery = "UPDATE `register` SET `First_Name`='{$_POST['first_name']}', `Last_Name`='{$_POST['last_name']}', `Breed`='{$_POST['breed']}', Weight='{$_POST['weight']}', `Age`={$_POST['age']}, Sex='{$_POST['sex']}' WHERE `reg_id`={$_GET['reg_id']}";
mysqli_query($con,$UpdateQuery);
header("Location: your display page");
};