Updating a single MySQL row - php

Question

I have a table displaying the content of a MySQL table. For every row I added an 'edit button' so our users can update the content.
The 'edit button' goes to a link ?edit_entry.php?sid=4 with 4 the sid of the entry.
This works but I get a blank form.
Question 1: Is there any way to already display the content of the specific MySQL row in the text fields of the form?
Here is the edit_entry.php code:
<?php require('includes/config.php');
//if not logged in redirect to login page
if(!$user->is_logged_in()){ header('Location: login.php'); }
// Create connection
$conn = new mysqli(DBHOST, DBUSER, DBPASS, DBNAME);
// Check connection
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
$sid = $_GET['sid'];
$sql = "SELECT * FROM orders WHERE sid = '$sid'";
$result = $conn->query($sql);
if ($result->num_rows > 0) {
while($row = mysqli_fetch_array($sql)) {
$sid = $row['sid'];
$q1_requested_by = $row['q1_requested_by'];
$q2_productname = $row['q2_productname'];
$q3_supplier = $row['q3_supplier'];
$q4_productnumber = $row['q4_productnumber'];
$q5_quantity = $row['q5_quantity'];
$q6_price = $row['q6_price'];
$q7_budget = $row['q7_budget'];
$q8_link = $row['q8_link'];
}
?>
<form action="update_script.php" method="post">
<input type="hidden" name="sid" value="<?=$sid;?>">
Requested by: <input id="q1" type="text" style="width:400px" name="ud_q1_requested_by" value="<?=$q1_requested_by?>" required="true" tabindex="1"><br>
Product name: <input id="q2" type="text" style="width:400px" name="ud_q2_productname" value="<?=$q2_productname?>" required="true" tabindex="2"><br>
Supplier: <input id="q3" type="text" style="width:400px" name="ud_q3_supplier" value="<?=$q3_supplier?>" required="true" tabindex="3"><br>
Product number: <input id="q4" type="text" style="width:400px" name="ud_q4_productnumber" value="<?=$q4_productnumber?>" required="true" tabindex="4"><br>
Quantity: <input id="q5" type="text" style="width:400px" name="ud_q5_quantity" value="<?=$q5_quantity?>" required="true" tabindex="5"><br>
Price: <input id="q6" type="text" style="width:400px" name="ud_q6_price" value="<?=$q6_price?>" tabindex="6"><br>
Budget: <input id="q7" type="text" style="width:400px" name="ud_q7_budget" value="<?=$q7_budget?>" tabindex="7"><br>
Link: <input id="q8" type="text" style="width:400px" name="ud_q8_link" value="<?=$q8_link?>" tabindex="8"><br>
<input type="submit" name="submit" id="submit" value="Update your input!" tabindex="9" />
</form>
<?php
}else{
echo 'No entry found. Go back';
}
?>
And here is update_script.php:
<?php require('includes/config.php');
//if not logged in redirect to login page
if(!$user->is_logged_in()){ header('Location: login.php'); }
// Create connection
$conn = new mysqli(DBHOST, DBUSER, DBPASS, DBNAME);
// Check connection
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
$sid = $_POST["sid"];
$ud_q1_requested_by = mysqli_real_escape_string($_POST["ud_q1_requested_by"]);
$ud_q2_productname = mysqli_real_escape_string($_POST["ud_q2_productname"]);
$ud_q3_supplier = mysqli_real_escape_string($_POST["ud_q3_supplier"]);
$ud_q4_productnumber = mysqli_real_escape_string($_POST["ud_q4_productnumber"]);
$ud_q5_quantity = mysqli_real_escape_string($_POST["ud_q5_quantity"]);
$ud_q6_price = mysqli_real_escape_string($_POST["ud_q6_price"]);
$ud_q7_budget = mysqli_real_escape_string($_POST["ud_q7_budget"]);
$ud_q8_link = mysqli_real_escape_string($_POST["ud_q8_link"]);
$sql= "UPDATE orders
SET q1_requested_by = '$ud_q1_requested_by', q2_productname = '$ud_q2_productname', ud_q3_supplier = '$ud_q3_supplier', ud_q4_productnumber = '$ud_q4_productnumber', ud_q5_quantity = '$ud_q5_quantity', ud_q6_price = '$ud_q6_price', ud_q7_budget = '$ud_q7_budget', ud_q8_link = '$ud_q8_link'
WHERE sid='$sid'";
$result = $conn->query($sql);
if(mysqli_affected_rows()>=1){
echo "<p>($sid) Record Updated<p>";
}else{
echo "<p>($sid) Not Updated<p>";
}
?>
There must be a problem in this last part because I get the (4) Not updated message.
Question 2: Does anyone see the problem here?
I've been trying a few things to tackle the problem but neither are working.
Thank you

Answer 1

mysqli_real_escape method requires the connection to be provided; this was not the case in deprecated mysqli_* methods..
see documentation at http://php.net/manual/en/mysqli.real-escape-string.php
In your case, since you are using object of mysqli:
$conn->real_escape_string($string)
Also for the record, you have a possible inject despite your attempts not to.
You should update $sid = $_POST["sid"]; to $sid = (int) $_POST["sid"]; if it is supposed to be an integer or escape it as well.
With this many variables needing to be escaped though, you should probably look at how to conduct a prepared statement. http://php.net/manual/en/mysqli.quickstart.prepared-statements.php

Answer 2

You use mysqli, not mysql that is good news.
But you continue to use old techniques to pass parameter to query.
So let just try to bind parameters as it should be done with mysqli:
$sql= "UPDATE orders
SET
q1_requested_by = ? ,
q2_productname = ?,
ud_q3_supplier = ?,
ud_q4_productnumber = ?,
ud_q5_quantity = ?,
ud_q6_price = ?,
ud_q7_budget = ?,
ud_q8_link = ?
WHERE sid=? ";
$stmt = $mysqli->prepare($sql);
$stmt->bind_param('ssssiddsi', $ud_q1_requested_by, $ud_q2_productname, $ud_q3_supplier, $ud_q4_productnumber, $ud_q5_quantity, $ud_q6_price, $ud_q7_budget, $ud_q8_link, $sid);
$result = $stmt->execute();
if($result && $stmt->affected_rows>0){
echo "<p>($sid) Record Updated<p>";
}else{
echo "Error:\n";
print_r($stmt->error_list);
echo "<p>($sid) Not Updated<p>";
}

Answer 3

I got it to work using the following code:
<?php require('includes/config.php');
//if not logged in redirect to login page
if(!$user->is_logged_in()){ header('Location: login.php'); }
$conn = new mysqli(DBHOST, DBUSER, DBPASS, DBNAME);
// Check connection
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
$sid = (int)$_POST["sid"];
$ud_q1_requested_by = $conn->real_escape_string($_POST["ud_q1_requested_by"]);
$ud_q2_productname = $conn->real_escape_string($_POST["ud_q2_productname"]);
$ud_q3_supplier = $conn->real_escape_string($_POST["ud_q3_supplier"]);
$ud_q4_productnumber = $conn->real_escape_string($_POST["ud_q4_productnumber"]);
$ud_q5_quantity = $conn->real_escape_string($_POST["ud_q5_quantity"]);
$ud_q6_price = $conn->real_escape_string($_POST["ud_q6_price"]);
$ud_q7_budget = $conn->real_escape_string($_POST["ud_q7_budget"]);
$ud_q8_link = $conn->real_escape_string($_POST["ud_q8_link"]);
$sql= "UPDATE orders
SET
q1_requested_by = '$ud_q1_requested_by',
q2_productname = '$ud_q2_productname',
q3_supplier = '$ud_q3_supplier',
q4_productnumber = '$ud_q4_productnumber',
q5_quantity = '$ud_q5_quantity',
q6_price = '$ud_q6_price',
q7_budget = '$ud_q7_budget',
q8_link = '$ud_q8_link'
WHERE sid='$sid'";
$result = $conn->query($sql);
header("Location: edit_orders.php");
?>
which is just simple query, as the original form to enter a new row of data also does. I also decided to remove the error handling at the end since it didn't seem to work with mysqli_affected_rows()>0...
It's probably not a very elegant solution, but it works. Still I'd like to learn more so if anybody would have a useful link explaining php+mysqli basics that would help me much. The links to php.net or mysql.com are for me too brief at this moment though, for me they don't explain what is going on. I'm a total novice to php and mysql and could use some more explanatory/introductary text, maybe with examples, but mostly providing me with an overview of what is going on... Thanks anyway for all the help!