pulling database and update database - php - php

I have rows showing products and their stockings.
I can pull out records from the database but somehow I am stuck at the editing part. When I click on edit I don't know how to pass the id so I can use the id to select what is needed to be selected in the table.
I have something like stock.php which shows all item_name and stock
<?php
$sql = "SELECT * FROM inventory";
$result = mysqli_query($mysqli,$sql);
//make sure database queries
if (!$result) {
echo "DB Error, could not query the database\n";
echo 'MySQL Error: ' . mysql_error();
exit;
}
if ($result->num_rows > 0) {
echo "<table><tr><td>Name</td>
<td>Stock</td>
</tr>";
// output data of each row
while($row = $result->fetch_assoc()) {
$id = $row['id'];
echo "<tr>
<td>".$row["item_name"]."</td>
<td>".$row["stock"]."</td>
<td>
<form action='edit.php' method='POST'>
<input type='hidden' name='$id' value='$id'/>
<input type='submit' name='edit' value='edit' />
</form>
</td>
</tr>";
}
echo "</table>";
} else {
echo "0 results";
}
?>
in my edit.php I have something like this which is giving me error because the $id is not passed
include_once "init.php";
if ($_SERVER['REQUEST_METHOD']=='POST') {
// query the table by matching up the int id
$sql = "SELECT * FROM inventory WHERE id = '$id'";
}
I want to pull out the data again in a new page and then having input box again to let users update stock # or even the product name and others if necessary.

There is an error in your input declaration. HTML items can't have names that start with special characters (like the $). You should be setting the variable-based names this way:
<input type='hidden' name='".$id."' value='".$id."'/>
Also in your edit.php, your SQL statement has a bug.
$sql = "SELECT * FROM inventory WHERE id = '$id'";
should be:
$sql = "SELECT * FROM inventory WHERE id = ".intval($id);

You need to do the following updates:
stock.php
<input type='hidden' name='id' value='$id'/>
edit.php
$sql = "SELECT * FROM inventory WHERE id = '".$_POST["id"]."'";
you are passing the current id value as the post var name, the var's name should be "id"

Related

$_POST Insert into many to many, wrong PHP Syntax?

EDIT: IGNORE ANY SQL INJECTIONS OR VULNERABLE CODE STATEMENTS :D
(School Project).
I wish to create a insert form on my webpage where I can select an artist from a table, including a song from a table and combine them for an insert into a combined foreign key table.
I have managed to do selects and insert with only individual artist and song drop-downs on my web-page, but would wish for combining the two ID's from each table to combine them to a many to many relative table. But when I press the submit button nothing happens, and I'm a beginner and don't know if I'm missing any important bits of actually Posting the information.
For troubleshooting I have tried my code, and tested it. I see if I remove my code theres no problem, so the problem persists on the syntax I believe, as the first dropdown shows, alongside the second dropdown and submit button, but the problem is within the actual processing and SQL query part, where it never goes to the DB..
The problem:
As you can see below I have a the text Song Name appear with a drop-down menu in the bottom left corner including the Artist Name with a submit button. But my problem persists as the select and then insert from the two drop downs into the combined table does not work, it does not actually submit, I want it to post into the DB what can I do. But somethings off? I would appreciate any questions or help, this community is so amazing and wonderful to operate in!
Database
PHP
<form method='POST'>
<?php
include('connect_mysql.php');
if(isset($_POST["mangetilmange"])) {
$song_id = $_POST["song_id"];
$artist_id = $_POST["artist_id"];
$sql ="INSERT INTO artist_has_song (song_id, artist_id) VALUES
('$song_id', '$artist_id')";
if($conn->query($sql)) {
echo "Completed";
} else {
echo "Blablalbablablablablablablabl $sql
($conn->error.";
}
}
?>
Song Name
<?php
$sql = "SELECT * FROM song";
$resultat = $conn->query($sql);
echo "<select name='song_id'>";
while ($rad = $resultat->fetch_assoc()) {
$song_id = $rad["song_id"];
$songname = $rad["songname"];
echo "<option value='$song_id'>$songname</option>";
}
echo "</select>";
?>
Artist Name
<?php
$sql = "SELECT * FROM artist";
$resultat = $conn->query($sql);
echo "<select name='artist_id'>";
while ($rad = $resultat->fetch_assoc()) {
$artist_id = $rad["artist_id"];
$artistname = $rad["artistname"];
echo "<option value='$artist_id'>$artistname</option>";
}
echo "</select>";
?>
</form>
<input type="submit" name="mangetilmange" value ="Submit">
change you code to this:
<form method='POST'>
<?php
include('connect_mysql.php');
if(isset($_POST["mangetilmange"])) {
$song_id = $_POST["song_id"];
$artist_id = $_POST["artist_id"];
$sql ="INSERT INTO artist_has_song (song_id, artist_id) VALUES
('$song_id', '$artist_id')";
if($conn->query($sql)) {
echo "Completed";
} else {
echo "Blablalbablablablablablablabl";
}
}
?>
Song Name
<?php
$sql = "SELECT * FROM song";
$resultat = $conn->query($sql);
echo "<select name='song_id'>";
while ($rad = $resultat->fetch_assoc()) {
$song_id = $rad["song_id"];
$songname = $rad["songname"];
echo "<option value='$song_id'>$songname</option>";
}
echo "</select>";
?>
Artist Name
<?php
$sql = "SELECT * FROM artist";
$resultat = $conn->query($sql);
echo "<select name='artist_id'>";
while ($rad = $resultat->fetch_assoc()) {
$artist_id = $rad["artist_id"];
$artistname = $rad["artistname"];
echo "<option value='$artist_id'>$artistname</option>";
}
echo "</select>";
?>
<input type="submit" name="mangetilmange" value ="Submit">
</form>

Get comments by the ID of the page

Hello i have created a databse which store the information sended by the form on my page.
The structure of the database is this :
cid(comment id) uid(value='Anonymous') id(of the page) date message(text of the message)
So when i goes to a particular page of my website, for example http://miostio.com/page.php?id=15
here i can put a comment by a form which send the information that u can see up in my database.
Now on my database are stored the id of the page in which i have putted the comments, but when i try to see the comment in that page by the function : getComments($conn); ,here are displayed all the comments saved in the database and not only the comments with the id of the page.
I want that the comments displayed corresponds to the id of the page, in page with id(15) display the comment of the page with id(15), in page with id(10) display the comment of the page with id(10) exc ...
PHP --> form that send data
echo "<form method='POST' action='".setComments($conn)."'>
<input type='hidden' name='id' value='".$row['id']."'>
<input type='hidden' name='uid' value='Anonymous'>
<input type='hidden' name='date' value='".date('Y-m-d H:i:s')."'>
<textarea name='message'></textarea><br>
<button name='commentSubmit' type='submit' class='comm-btn'>Comment</button>
</form>";
getComments($conn);
other PHP CODE which contain the function called by the form
function setComments($conn) {
if (isset($_POST['commentSubmit'])){
$uid = $_POST['uid'];
$date = $_POST['date'];
$message = $_POST['message'];
$id = $_POST['id'];
$sql = "INSERT INTO comments (uid, date, message, id) VALUES ('$uid', '$date', '$message', '$id')";
$result = $conn->query($sql);
}
}
function getComments ($conn) {
$sql = "SELECT * FROM comments WHERE id = id ORDER BY cid DESC";
$result = $conn->query($sql);
while($row = $result->fetch_assoc()) {
echo "<div class='comment-box'><p>";
echo $row['uid']."<br>";
echo $row['date']."<br>";
echo nl2br($row['message']);
echo "</p></div>";
}
}
You got at least two mistakes (I don't know yet if the rest is ok and working):
1st: Your sql statement doesn't include the variable you're aming for, it just says kinda 'if 1=1'. So change it to:
$sql = "SELECT * FROM comments WHERE id = $id ORDER BY cid DESC"
2nd: You don't have yet $id available in that function.
So include that:
function getComments ($conn) {
$id = intval($_POST['id']); // cast to int for security
$sql = "SELECT * FROM comments WHERE id = $id ORDER BY cid DESC";
$result = $conn->query($sql);
while($row = $result->fetch_assoc()) {
echo "<div class='comment-box'><p>";
echo $row['uid']."<br>";
echo $row['date']."<br>";
echo nl2br($row['message']);
echo "</p></div>";
}
}
"SELECT * FROM comments WHERE id = id ORDER BY cid DESC"
id always === id
You need to give a real id there...
"SELECT * FROM comments WHERE id = $id ORDER BY cid DESC"
Would consider protecting it from sql injection like this:
"SELECT * FROM comments WHERE id = " . (int)$id . "ORDER BY cid DESC"

Submit data in a textbox from a while loop to database

I need to enter scores for all subjects offered by all students in a class simultaneously. So I retrieved the students ID, retrieved the list of subjects being offered by the students, and placed a textbox under each subject.
Now, I want to submit the score in the database as well as the subject name and the student ID, but the score is not storing, just the subject name and the student ID.
Here is my code:
<form method="post">
<?php
include "includes/dbcon.php";
$subject_name ="";
echo "<table border='1'><thead><tr><td>Students Name</td>";
$query_subjects = mysqli_query($link,"SELECT * FROM junior_subjects ORDER BY subject_name ASC");
while ($row_subject=mysqli_fetch_array($query_subjects))
{
$subject_name .= $row_subject['subject_name'];
echo "<td>".$row_subject['subject_name']."</td>";
}
echo "</tr></thead>";
$query_students = mysqli_query($link,"SELECT * FROM students WHERE class_cat='Junior'");
while ($row_students=mysqli_fetch_array($query_students))
{
$student_id = $row_students['student_id'];
echo "<tr><td>".$row_students['student_id']."</td>";
$query_subjects2 = mysqli_query($link,"SELECT * FROM junior_subjects ORDER BY subject_name ASC");
while ($row_subject2 =mysqli_fetch_array($query_subjects2))
{
$subject_name2 =$row_subject2['subject_name'];
echo "<td>
<input type='text' hidden name='$subject_name2'>
<input type='text' size='4' name='$subject_name2'>
</td>";
/////
if (isset($_POST['submit']))
{
$score = $_POST[$subject_name2];
mysqli_query($link,"INSERT INTO score_sheet(student_id,subject_name,score) VALUES('$student_id','$subject_name2','$score') ");
}
}
}
?>
<input type='submit' name='submit'>
</form>
You should have the input score as array and make a foreach loop to insert the query.
You should have the input field like this
And do a foreach loop like this
$score = $_POST['score'];
foreach ($score as $key)
{
$query = "INSERT INTO score_sheet(student_id,subject_name,score) VALUES('$student_id','$subject_name2','$key') ";
$query = mysqli_query($link,$query);
}
Note :
You should not have have two forms inside it.
I have made an eval for you
Warning :
It is not at all a good practise to have such a bulk entry.

Edit Books Records PHP

I am currently in the middle of constructing a website for my own personal education to better myselft at work and have encountered a problem.
I am wanting to have the ability to update records located on my database via a form.
This is what I have got so far, am i on the right lines?
Thanks in advance
Edit Book Form
<?php
include 'database_conn.php'; // make db connection
//Get the bookISBN from the request stream
$bookISBN = $_REQUEST['bookISBN'];
//use that code in an sql statement to retrieve the details for the Book
$sql = "SELECT bookISBN bookTitle bookYear bookPrice FROM nbc_book where bookISBN = $bookISBN" ;
//Execute the query
$rsAdmin = mysqli_query($conn, $sql) or die(mysqli_error($conn));
//get the records from the result set into variables
$adminBook = mysqli_fetch_array($rsAdmin);
$bookISBN = $adminBook['bookISBN'];
$bookTitle= $adminBook['bookTitle'];
$bookYear= $adminBook['bookYear'];
$bookPrice= $adminBook['bookPrice'];
//Display those variables in a form
?>
<form action ='editBook.php' method = 'GET'>
<?php
echo "StudentID: $bookISBN<br />";
echo "<input type = 'hidden' name = 'bookISBN' value ='$bookISBN' />";
echo "<input type ='text' name'$bookTitle' value='$bookTitle'>";
echo "Book Title:<input type ='text' name'bookTitle' value='$bookTitle'><br />";
echo "Book Year:<input type ='text' name'bookYear' value='$bookYear'><br />";
echo "Book Price:<input type ='text' name'bookPrice' value='$bookPrice'><br />";
echo "<input type ='submit' value='Save'/>";
mysqli_close($conn);
?>
</form>
Edit Book Process
<?php
// make db connection
include 'database_conn.php';
//Get the bookISBN from the request stream
$bookISBN = $_REQUEST['bookISBN'];
$bookTitle = $_REQUEST['bookTitle'];
$bookYear = $_REQUEST['bookYear'];
$bookPrice = $_REQUEST['bookPrice'];
//construct an SQL Statement
$sql = "UPDATE nbc_books set bookTitle ='$bookTitle', bookYear ='$bookYear, $bookPrice where bookISBN = '$bookISBN'";
//execute the SQL statment
$rsBookUpdate = mysql_query ($bookUpdateSQL);
if ($rsBookUpdate === false) {
echo 'Updating Book failed $bookISBN, $bookTitle failed: ' . mysql_error ();
}
?>
<!--draw link taking them back to books list-->
Go back to all book records
you missed quote (`): please check with your database field and query.
$sql = "UPDATE nbc_books set bookTitle ='$bookTitle', bookYear ='$bookYear', bookPrice = '$bookPrice' where bookISBN = '$bookISBN'";

When form submitted then all rows take one value

I am newbie in PHP and with this less knowledge of PHP i developed a form to update the rows of MySQL table. But the problem is that if i edit one row in index.php file and submit it then that row value comes to all rows of the table.
I want to change the edited inputs and the rest inputs should be unchanged.
Please note that first row budget value will be added when second row budget value and will be inserted in total input and will save to database
This is how it looks
this is the index.php file
<?php
$con=mysqli_connect("127.0.0.1","root","","ji001");
$result = mysqli_query($con,"SELECT * FROM finance")
or die("Error: ".mysqli_error($con));
while($row = mysqli_fetch_array($result))
{ $Budget = $row['Budget'];
$Availed_in_Regions = $row['Availed_in_Regions'];
echo "<form style='width:780px' action='update2.php' method='post' class='form-group'>
id<input type='text' name='Budget' value='".$row['ID']."'>
Budget<input type='text' name='Budget' value='".$row['Budget']."'>
Availed in Regions <input type='text' name='Availed_in_Regions' value='".$row['Availed_in_Regions']."'>
<input type='Submit'>
</form>";
}
?>
This is the update2.php file
<?php
mysql_connect('127.0.0.1', 'root', '') or die(mysql_error());
mysql_select_db("ji001") or die(mysql_error());
$ud_Budget = mysql_real_escape_string($_POST["Budget"]);
$ud_Availed_in_Regions = mysql_real_escape_string($_POST["Availed_in_Regions"]);
$query="UPDATE finance SET Budget = '$ud_Budget', Availed_in_Regions = '$ud_Availed_in_Regions'";
mysql_query($query)or die(mysql_error());
if(mysql_affected_rows()>=1){
echo "<p>Record Updated<p>";
}else{
echo "<p>Not Updated<p>";
}
?>
Firstly, your form having typo id and name having same name for the name attribute i.e. name='Budget'
index.php
echo "<form style='width:780px' action='update2.php' method='post' class='form-group'>";
while($row = mysqli_fetch_array($result))
{
$Budget = $row['Budget'];
$Availed_in_Regions = $row['Availed_in_Regions'];
echo "id<input type='text' name='id[]' value='".$row['ID']."'>
Budget<input type='text' name='Budget[]' value='".$row['Budget']."'>
Availed in Regions <input type='text' name='Availed_in_Regions[]' value='".$row['Availed_in_Regions']."'>";
}
echo "<input type='Submit' value='Submit'></form>";
and you need to change your update query from
update2.php
$ud_id = $_POST["id"];
$ud_Budget = array_map('mysql_real_escape_string', $_POST['Budget']);
$ud_Availed_in_Regions = array_map('mysql_real_escape_string',$_POST["Availed_in_Regions"]);
foreach($ud_id as $key => $value){
$query = "UPDATE finance SET Budget = '$ud_Budget[$key]', Availed_in_Regions = '$ud_Availed_in_Regions[$key]' where ID = $value";
mysql_query($query)or die(mysql_error());
if(mysql_affected_rows()>=1){
echo "<p>Record Updated<p>";
}else{
echo "<p>Not Updated<p>";
}
}
Here I have added where condition which is required to identify which row you need to update and
NOTICE : You were mixing two API within index.php you were using mysqli_ and within update2.php its mysql
You are not using a where clause in the $query query.
it should be something like this
$query="UPDATE finance SET Budget = '$ud_Budget', Availed_in_Regions = '$ud_Availed_in_Regions' WHERE id = '$id'";
You should also pass this id in the form, also change the name of the input field containing the id...
Because you actually SELECT every row in your table.
UPDATE finance SET Budget = '$ud_Budget', Availed_in_Regions = '$ud_Availed_in_Regions';
There is no WHERE clause (link) in your query you have to use it if you wanna update a row in your table.
Pass $id to your update2.php and use this query instead:
UPDATE finance SET Budget = '$ud_Budget', Availed_in_Regions = '$ud_Availed_in_Regions' WHERE id = '$id';

Categories