Find username and change his status string on a database - php

Question

I have a code who prints the status of a player in HTML, but I want to add a button right on the side, and when I click it I want that status to change.
(There's a lot of players on the database and on the HTML, the problem I have is, when I click the button, the status of ALL the players change, so I need to find a way to find the steamid and change the status of that player by the steamid with the button and I don't know how to do it, here's the admin panel I'm trying to do: http://vanityrp.site.nfoservers.com/apply/admin.php)
Admin.php:
<?php
$servername = "localhost";
$username = "------";
$password = "------";
$dbname = "-----";
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
$sql = "SELECT avatar, name, status FROM Apps";
$result = $conn->query($sql);
if ($result->num_rows > 0) {
// output data of each row
while($row = $result->fetch_assoc()) {
echo "
<form action='../apply/steamauth/status.php' method='post'>
<div class='advert'><img src='".$row["avatar"]. "'>\n</div><br>
<div name='username2' class='advert'>Username: ".$row["name"]. "\n<br></div>
<div class='advert'>Status: <font color='orange'>".$row["status"]."</font></div>\n<br>
<input type='submit' value='Deny' name='deny'/>
<input type='submit' value='Accept' name='accept'/>
<input type='submit' value='Remove' name='remove'/>
</form>
<hr>
";
}
} else {
}
$conn->close();
?>
And now status.php:
<?php
$servername = "localhost";
$username = "-----";
$password = "----";
$dbname = "-----";
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
$denied = $_POST['deny'];
$accepted = $_POST['accept'];
$remove = $_POST['remove'];
$username = $_POST['username2'];
if($accepted){
$sql = "UPDATE Apps SET status = replace(status,'Pending','Accepted.');";
$sql = "UPDATE Apps SET status = replace(status,'Denied','Accepted.');";
}elseif($denied){
$sql = "UPDATE Apps SET status = replace(status,'Pending','Denied.');";
$sql = "UPDATE Apps SET status = replace(status,'Accepted','Denied.');";
}elseif($remove){
#$sql = "DELETE FROM Apps WHERE id=$username";
}
$result = $conn->query($sql);
if ($conn->query($sql) === TRUE) {
echo "App has been denied/accepted successfully.";
header( "refresh:3;url=http://vanityrp.site.nfoservers.com/apply/admin.php" );
} else {
echo "Error: " . $sql . "<br>" . $conn->error;
header("refresh:3;url=http://vanityrp.site.nfoservers.com/apply/admin.php");
}
?>

Answer 1

Try the following changes in your code
<form action='../apply/steamauth/status.php' method='post'>
<div class='advert'><img src='".$row["avatar"]. "'>\n</div><br>
<input type="hidden" name="userid" value='".$row["id"]."'/> <!--added a hidden variable "user your id column name in value"-->
<div name='username2' class='advert'>Username: ".$row["name"]. "\n<br></div>
<div class='advert'>Status: <font color='orange'>".$row["status"]."</font></div>\n<br>
<input type='submit' value='Deny' name='deny'/>
<input type='submit' value='Accept' name='accept'/>
<input type='submit' value='Remove' name='remove'/>
</form>
and in status.php
$denied = $_POST['deny'];
$accepted = $_POST['accept'];
$remove = $_POST['remove'];
$username = $_POST['username2'];
$id = $_POST['userid']; // get the hidden variable here
if($accepted){
$sql = "UPDATE Apps SET `status` = 'Accepted.' where id = $id;"; //check the condition
}elseif($denied){
$sql = "UPDATE Apps SET `status` = 'Denied.' where id = $id;";
}elseif($remove){
#$sql = "DELETE FROM Apps WHERE id=$username";
}

Answer 2

Change your query to select the steamid as well
$sql = "SELECT avatar, name, status, steamid FROM Apps";
Then in your form add a hidden input with the steamid as the value.
<input type='hidden' name='steamid' value='".$row['steamid']."' />
Then in your status.php
$steamid = $_POST['steamid'];
Then create prepared statements to help protect against SQL injection
$sql = "UPDATE Apps SET status = replace(status,'Pending','Accepted.') WHERE steamid = ?";
$stmt = $conn->prepare($sql);
$stmt->bind_param("i", $steamid);
$stmt->execute();

Answer 3

I think this can solve your problem:
<?php
$servername = "localhost";
$username = "------";
$password = "------";
$dbname = "-----";
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
$sql = "SELECT id, avatar, name, status FROM Apps";
$result = $conn->query($sql);
if ($result->num_rows > 0) {
// output data of each row
while($row = $result->fetch_assoc()) {
echo "
<form action='../apply/steamauth/status.php' method='post'>
<div class='advert'><img src='".$row["avatar"]. "'>\n</div><br>
<div name='username2' class='advert'>Username: ".$row["name"]. "\n<br></div>
<div class='advert'>Status: <font color='orange'>".$row["status"]."</font></div>\n<br>
<input type='submit' value='".$row["id"]. "' name='deny'/>
<input type='submit' value='".$row["id"]. "' name='accept'/>
<input type='submit' value='".$row["id"]. "' name='remove'/>
</form>
<hr>
";
}
} else {
}
$conn->close();
?>
+
<?php
$servername = "localhost";
$username = "-----";
$password = "----";
$dbname = "-----";
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
$denied = $_POST['deny'];
$accepted = $_POST['accept'];
$remove = $_POST['remove'];
$username = $_POST['username2'];
if($accepted){
$sql = "UPDATE Apps SET status = replace(status,'Pending','Accepted.') WHERE id='".$accepted."';";
$sql = "UPDATE Apps SET status = replace(status,'Denied','Accepted.') WHERE id='".$accepted."';";
}elseif($denied){
$sql = "UPDATE Apps SET status = replace(status,'Pending','Denied.') WHERE id='".$denied."';";
$sql = "UPDATE Apps SET status = replace(status,'Accepted','Denied.') WHERE id='".$denied."';";
}elseif($remove){
#$sql = "DELETE FROM Apps WHERE id={$remove}";
}
$result = $conn->query($sql);
if ($conn->query($sql) === TRUE) {
echo "App has been denied/accepted successfully.";
header( "refresh:3;url=http://vanityrp.site.nfoservers.com/apply/admin.php" );
} else {
echo "Error: " . $sql . "<br>" . $conn->error;
header("refresh:3;url=http://vanityrp.site.nfoservers.com/apply/admin.php");
}
?>

Answer 4

Try this
if($accepted){
$sql = "UPDATE Apps SET status = replace(status,'Pending','Accepted.') WHERE name='".$username."';";
$sql = "UPDATE Apps SET status = replace(status,'Denied','Accepted.') WHERE name='".$username."';";
}elseif($denied){
$sql = "UPDATE Apps SET status = replace(status,'Pending','Denied.') WHERE name='".$username."';";
$sql = "UPDATE Apps SET status = replace(status,'Accepted','Denied.') WHERE name='".$username."';";
}elseif($remove){
#$sql = "DELETE FROM Apps WHERE id={$remove}";
}