Database not updating (integration in woocommerce) - php

Question

I am using Wordpress / WooCommerce. My client doesn't want users to have to create an account to buy something, but still wants to store the customer address so it auto populates when the user comes back to the site for a future purpose.
I had a school project where I saved a note to a database (plain text in a textbox). It grabs the "notes" already in the database, and shows them to you, with an option to update the note. This updates the database entry.
I am trying to adapt this code to work with woocommerce. I haven't changed much besides the name of the table.
The database connects fine, and it pulls the content from the table as requested.
My issue is: the database is not updating the entry when I click "update". I'm not sure if this is because I'm trying to use it within woocommerce, and the shopping cart is causing issues? But it's practically the same code as my working school project.
You can see it working here (once you add something to your cart): http://www.onelifehealthycuisine.com/mobile/checkout/
Currently, I'm just trying to get it to update the address, once that works I'll add in the other cell's to update.
Database
Name: tbl_stored_address
| ID | ip_address | address | city | province | postal |
Test Entry: 2, 96.48.1.29, 123 fake street, vancouver, bc, v3c 5r6
function dbConnect(){
$db_host = 'xxx.xxx.com';
$db_un = 'xxxx';
$db_pass = 'xxxx';
$db_name = 'xxxx';
$pdo = new PDO("mysql:host=$db_host;dbname=$db_name;charset=utf8",$db_un,$db_pass);
mysql_connect($db_host, $db_un, $db_pass) or die(mysql_error());
mysql_select_db($db_name) or die(mysql_error());
}
dbConnect();
function getAddys(){
$user_id = '96.48.1.29'; //get user IP
$query = "SELECT tbl_stored_address.address, tbl_stored_address.id FROM tbl_stored_address WHERE tbl_stored_address.ip_address ='".$user_id."';";
$result = mysql_query($query) or die(mysql_error());
//saves number of rows returned
$rowCount = mysql_num_rows($result);
echo "<form enctype='multipart/form-data' action='form-checkout.php' method='post'>";
while ($row = mysql_fetch_array($result, MYSQL_ASSOC))
{
echo "<textarea name='address".$row['id']."' id='address".$row['id']."'>".$row['address']."</textarea><br/>";
}
echo "<br/><input type='submit' value='Update Note(s)' name='updateNote'/><br/>";
echo "</form>";
}
//this will check if the user clicked on "update" for a note, and then update the correct notes using the ID
if(isset($_POST['updateNote']))
{
$user_id = '96.48.1.29'; //get user IP
$query = "SELECT tbl_stored_address.id FROM tbl_stored_address WHERE tbl_stored_address.ip_address ='".$user_id."';";
$result = mysql_query($query) or die(mysql_error());
while ($row = mysql_fetch_array($result, MYSQL_ASSOC))
{
if((isset($_POST['address'.$row['id'].'']))){
$value = $_POST['address'.$row['id'].''];
$theID = $row['id'];
$query2 = "UPDATE tbl_stored_address SET tbl_stored_address.address='".mysql_real_escape_string($value)."' WHERE tbl_stored_address.id ='".$theID."';";
$result2 = mysql_query($query2) or die(mysql_error());
}
}
}
?>
<h2>Delivery Address</h2><br/><br/>
<?php getAddys(); ?>
****UPDATE****
I've tried adding the code to a page without woocommerce and accessing the the PHP page directly, and it updates the database fine: http://www.onelifehealthycuisine.com/mobile/wp-content/themes/onelife/page-test.php
So is it the fact that the URL doesn't end with a .php file? Or something in the woocommerce template not allowing me to run the form properly? I can't seem to figure it out.

Answer 1

Assuming tbl_stored_address.id is an int, this :
WHERE tbl_stored_address.id ='".$theID."'
won't match anything. Use
WHERE tbl_stored_address.id =".$theID."
That being said, you shouldn't using the mysql_ functions, and DEFINITELY should not be building your query using string concatenation. That being said, this is your script updated to use the MySQLi extension:
<?php
function dbConnect()
{
$db_host = 'xxx.xxx.com';
$db_un = 'xxxx';
$db_pass = 'xxxx';
$db_name = 'xxxx';
$conn = mysqli_connect($db_host, $db_un, $db_pass, $db_name) or die(mysqli_error());
}
dbConnect();
function getAddys()
{
$user_id = '96.48.1.29'; //get user IP
$query = "SELECT tbl_stored_address.address, tbl_stored_address.id FROM tbl_stored_address WHERE tbl_stored_address.ip_address = '" . $user_id . "';";
$result = mysqli_query($conn, $query) or die(mysqli_error($conn));
//saves number of rows returned
$rowCount = mysqli_num_rows($conn, $result);
echo "<form enctype='multipart/form-data' action='form-checkout.php' method='post'>";
while ($row = mysqli_fetch_assoc($conn, $result))
{
echo "<textarea name='address".$row['id']."' id='address" . $row['id'] . "'>" . $row['address'] . "</textarea><br/>";
}
echo "<br/><input type='submit' value='Update Note(s)' name='updateNote'/><br/>";
echo "</form>";
}
//this will check if the user clicked on "update" for a note, and then update the correct notes using the ID
if(isset($_POST['updateNote']))
{
$user_id = '96.48.1.29'; //get user IP
$query = "SELECT tbl_stored_address.id FROM tbl_stored_address WHERE tbl_stored_address.ip_address = '" . $user_id . "';";
$result = mysqli_query($conn, $query) or die(mysqli_error($conn));
while ($row = mysqli_fetch_assoc($conn, $result))
{
if((isset($_POST['address' . $row['id']])))
{
$value = $_POST['address' . $row['id']];
$theID = $row['id'];
$query2 = "UPDATE tbl_stored_address SET tbl_stored_address.address = '" . mysqli_real_escape_string($conn, $value) . "' WHERE tbl_stored_address.id = " . $theID . ";";
$result2 = mysqli_query($conn, $query2) or die(mysqli_error($conn));
}
}
}
?>
<h2>Delivery Address</h2><br /><br />
<?php getAddys(); ?>
The MySQLi extensions reverse the order of the parameters from what you may be used to, with the connection being the first parameter. Like the MySQL extension, if you omit the connection object, the extension functions will attempt to reuse an existing open connection.
Since we really don't want to use string concatenation in our SQL, you need to get familiar with using prepared statements, which the MySQli extension supports. Here's your code with prepared statements:
<?php
function dbConnect()
{
$db_host = 'xxx.xxx.com';
$db_un = 'xxxx';
$db_pass = 'xxxx';
$db_name = 'xxxx';
$conn = mysqli_connect($db_host, $db_un, $db_pass, $db_name) or die(mysqli_error());
}
dbConnect();
function getAddys()
{
$user_id = '96.48.1.29'; //get user IP
if ($query = mysqli_prepare($conn, "SELECT tbl_stored_address.address, tbl_stored_address.id FROM tbl_stored_address WHERE tbl_stored_address.ip_address = ?;"))
{
mysqli_stmt_bind_param($query, "s", $user_id); # 's' indicates that this parameter is a string
mysqli_stmt_execute($query);
mysqli_stmt_bind_result($query, $row);
echo "<form enctype='multipart/form-data' action='form-checkout.php' method='post'>";
while (mysqli_stmt_fetch(($query))
{
echo "<textarea name='address" . $row['id'] . "' id='address" . $row['id'] . "'>" . $row['address'] . "</textarea><br/>";
}
echo "<br/><input type='submit' value='Update Note(s)' name='updateNote'/><br/>";
echo "</form>";
mysqli_stmt_close($query);
}
}
//this will check if the user clicked on "update" for a note, and then update the correct notes using the ID
if(isset($_POST['updateNote']))
{
$user_id = '96.48.1.29'; //get user IP
if ($query = mysqli_prepare($conn, "SELECT tbl_stored_address.address, tbl_stored_address.id FROM tbl_stored_address WHERE tbl_stored_address.ip_address = ?;"))
{
mysqli_stmt_bind_param($query, "s", $user_id); # 's' indicates that this parameter is a string
mysqli_stmt_execute($query);
mysqli_stmt_bind_result($query, $row);
while (mysqli_stmt_fetch(($query))
{
if((isset($_POST['address' . $row['id']])))
{
$value = $_POST['address' . $row['id']];
$theID = $row['id'];
if ($updateQuery = mysqli_prepare($conn, "UPDATE tbl_stored_address SET tbl_stored_address.address = ? WHERE tbl_stored_address.id = ?;"))
{
$updateQuery = "UPDATE tbl_stored_address SET tbl_stored_address.address = ? WHERE tbl_stored_address.id = ?;";
mysqli_stmt_bind_param($updateQuery, "s", $value); # 's' indicates that this parameter is a string
mysqli_stmt_bind_param($updateQuery, "i", $theID); # 'i' indicates that this parameter is an integer
mysqli_stmt_execute($updateQuery);
}
}
}
mysqli_stmt_close($query);
}
}
?>
<h2>Delivery Address</h2><br /><br />
<?php getAddys(); ?>
There may be errors in the code above, so caveat emptor.
You can find everything you need to learn the MySQLi extension on the PHP.net website: http://php.net/manual/en/book.mysqli.php. You'll also find the docs for PDO, which was the last extension I used when coding in PHP.