Insert into | on duplicate key update to add new row - php

Question

I'm trying to update a table, with the ability of adding new rows.
The script is updating the values, but not inserting new rows. When I add a row, it updates the first one.
This is my table:
TABLE `tbl_orderdetail` (
`id` int(11) NOT NULL AUTO_INCREMENT,
`order_id` int(11) DEFAULT NULL,
`product_name` varchar(255) DEFAULT NULL,
`quantity` varchar(255) DEFAULT NULL,
`price` varchar(255) DEFAULT NULL,
`discount` int(11) DEFAULT NULL,
`amount` varchar(255) DEFAULT NULL,
PRIMARY KEY (`id`)
And this is my update code:
<?php
if (isset($_POST['update'])) {
$size = count($_POST['quantity']);
$size = count($_POST['product_name']);
$size = count($_POST['price']);
$size = count($_POST['discount']);
$size = count($_POST['amount']);
$i = 0;
while ($i<$size) {
$quantity= $_POST['quantity'][$i];
$product_name= $_POST['product_name'][$i];
$price= $_POST['price'][$i];
$discount= $_POST['discount'][$i];
$amount= $_POST['amount'][$i];
$id= $_POST['id'][$i];
$order_id= $_POST['order_id'][$i];
$query = ("INSERT INTO tbl_orderdetail (id, order_id, quantity, product_name, price, discount, amount )
VALUES ('$id', '$order_id', '$quantity', '$product_name', '$price', '$discount', '$amount' )
ON DUPLICATE KEY UPDATE quantity = '$quantity', product_name = '$product_name', price = '$price', discount = '$discount', amount = '$amount'");
mysql_query($query) or die(mysql_error());
++$i;
}
header("Location: $PHP_SELF");
mysql_close();
}
?>
Here's my form:
<form method="post" action="">
<div class="box-body">
<table class="table table-bordered table-hover">
<?php
$sql = "SELECT * FROM tbl_orderdetail WHERE order_id=$id";
$result = mysql_query($sql);
$count=mysql_num_rows($result);
?>
<thead>
<th>No</th>
<th>Qtde</th>
<th>Descrição</th>
<th>Unitário</th>
<th>Desc.(%)</th>
<th>Valor</th>
<th><input type="button" value="+" id="add" class="btn btn-primary"></th>
</thead>
<tbody id="orderdetail" class="detail">
<?php
while ($rows = mysql_fetch_array($result)){
?>
<tr>
<input type="hidden" name="id[]" value="<?php echo $rows['id']; ?>" >
<td width="2%" class="no">1</td>
<td width="10%"><input type="text" id="quantity" class="form-control quantity" name="quantity[]" value="<?php echo $rows['quantity']; ?>"></td>
<td width="60%"><input type="text" id="product_name" class="form-control product_name" name="product_name[]" value="<?php echo $rows['product_name']; ?>"></td>
<td width="8%"><input type="text" id="price" class="form-control price" name="price[]" value="<?php echo $rows['price']; ?>"></td>
<td width="4%"><input type="text" id="discount" class="form-control discount" name="discount[]" value="<?php echo $rows['discount']; ?>"></td>
<td width="10%"><input type="text" id="amount" class="form-control amount" name="amount[]" value="<?php echo $rows['amount']; ?>"></td>
<td width="6%"><a href="#" class="remove">Excluir</td>
</tr>
<?php } ?>
</tbody>
<tfoot>
<th></th>
<th></th>
<th></th>
<th></th>
<th style="text-align:center;" >Total R$</th>
<th style="text-align:center;" class="total">0</th>
</tfoot>
</table>
<input type="submit" class="btn btn-primary" name="update" id="update" value="Salvar">
</form>

Answer 1

First: DO NOT use php's mysql library, use mysqli or PDO instead
Second: Your code is vulnerable to sql injection - best fix would be to use prepared statement (I'd advice again to look into PDO). Never ever trust anything that might be coming from a user (i.e all the POST, GET stuff).
Third: for development always display all errors, warnings, notices etc (You might have seen at least the deprecated warning for the mysql library - if working with php >= 5.5 - and the careless use of $_POST values)
Fourth: I'm sorry to say that your code makes not much of a sense to me:
1.)
$size = count($_POST['quantity']);
$size = count($_POST['product_name']);
// ... etc ...
$size = count($_POST['amount']);
Here you are only taking the size of amount into account. so all the lines with $size = before the last one are senseless.
2.) In the while loop we find lines similar to those:
$id= $_POST['id'][$i];
and $i is incremented until it's the size of $_POST['amount']. What if the size of $_POST['id'] is not the same as the $_POST['amount']?
3.) You are using auto_increment for the primary key but inserting the id manually. I'd remove the auto_increment here.
So if I'd guess I would try echoing $query and check if either the while-loop is not running as often as it should or if the id values are somehow strange.
== Edit ==
I just saw your html output right now. As J.Han pointed out: your script does exactly what it was said that it should do:
You are reading all the results from the database and after editing and submitting it the new values should overwrite the old ones.
If you want to use that script with insert you have to set the id to one that is not yet in your database (i.e. set a value of zero in html and catch that in the php part to generate a valid new id)