sql INSERT with a php form failing - php

Question

I have an update form which I am trying to enable updating fields but struggling to update the fields when submitting - perhaps I am missing something very obvious here.
Here is my form:
<form action="actions/updateDoc.php" method="POST">
<input type="text" value="<?php echo $doc['doc_title'] ?>" name="doc_title" />
<br />
<input type="submit" value="Update" name="submit" />
</form>
Here is the script to action that form:
<?php
if(isset($_POST["submit"])){
$hostname='localhost';
$username='******';
$password='******';
try {
$dbh = new PDO("mysql:host=$hostname;dbname=******",$username,$password);
$dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); // <== add this line
$doc_title = $_POST['doc_title'];
$sql = "UPDATE doc_list (doc_title) SET ('".$_POST["doc_title"]."')";
if ($dbh->query($sql)) {
header ('Location: ../docEdit.php');
}
else{
}
$dbh = null;
}
catch(PDOException $e)
{
echo $e->getMessage();
}
}
?>
The script runs but getting a blank screen and no update occurs. I have now taken some code out to show just updating 1 row, I get the following error:
SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '(doc_title) SET ('Document content sdfsd')' at line 1

Answer 1

First, add the doc_id to your form (as a hidden input) -
<form action="actions/updateDoc.php" method="POST">
<input type="text" value="<?php echo $doc['doc_title'] ?>" name="doc_title" />
<input type="hidden" value="<?php echo $doc['doc_id'] ?>" name="doc_id" />
<br />
<input type="submit" value="Update" name="submit" />
</form>
Then change your php code to get the doc_id (and use prepared statement/placeholders) -
<?php
if(isset($_POST["submit"])){
$hostname='localhost';
$username='******';
$password='******';
try {
$dbh = new PDO("mysql:host=$hostname;dbname=******",$username,$password);
$dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); // <== add this line
$sql = "UPDATE doc_list SET doc_title = :doc_title WHERE doc_id = :doc_id";
$query = $dbh->prepare($sql);
$query->execute(array(":doc_title"=>$_POST["doc_title"], ":doc_id"=> $_POST["doc_id"]));
if ($query) {
header ('Location: ../docEdit.php');
}
else{
}
$dbh = null;
}
catch(PDOException $e)
{
echo $e->getMessage();
}
}
?>