PHP SQL update checkboxes in db table - php

Question

I have a update.php page which checks checkbox values and updates the data in the DB.
For example, the sport_table looks like this (primary key is a combination of MemberID-Sport):
MemberID | Sport
John | Football
John | Rugby
John | Cricket
Paul | Football
Paul | Rugby
Mike | Cricket
So what I want to do is get get the value from the checkboxes on my webform and update them as necesary in the db table.
I have tried the following code:
$sport = $_POST["sport"];
for ($i=0; $i < sizeof($sport); $i++) {
$sql = "UPDATE sport_table
SET sport='$sport[$i]', MemberID='$username'";
$result = mysqli_query($conn, $sql);
But receive an errors duplicate keys when checking/unchecking boxes and then clicking update.

Answer 1

Making a few assumptions, this is where you might need to be looking:
First, if using checkboxes, you need to allow for multiple answers in the submission with HTML that looks something like this:
<input type="checkbox" name="sport[]" value="Football">Football</input>
Note the [] in the field name. This ensures PHP will parse the field as an array which can have multiple values.
Second, PHP needs to process the array if it exists and always validate user input. Learn about SQL Injection, Never take content direct from the request and use in an SQL query. It will save you a heap of bother one day.
$validSports=array('Football','Rugby','Cricket','Football');
// $_POST['sport'] will not be set if no boxes are checked
if(isset($_POST['sport']) &&
is_array($_POST['sport'])) {
// Remove previous entries from the table for this member.
$sql = "DELETE FROM sport_table WHERE MemberID='$username'";
$result = mysqli_query($conn, $sql);
foreach($_POST['sport'] as $sport) {
// See how we validate the user input here, there are other ways
if(in_array($sport, $validSports)) {
$sql = "INSERT INTO sport_table
SET sport='$sport[$i]', MemberID='$username'";
$result = mysqli_query($conn, $sql);
}
}
}
Thirdly, I've missed out the example code to keep it simple, but in practice, always check the $result value from mysqli_query and if $result === false then you need to handle the error - probably by writing to a log somewhere.
Finally, check the indexes on your sport_table to make it fast. An index on MemberID would be sufficient for the use cases above although a unique index on (MemberId,sport) may be more appropriate to mitigate against data duplication.