Use while loop to update database content, from a form - php

Question

My users have profile photos with captions. Each photo is stored under an auto incremented ID in a database table, so in order to display all relevant photos for an individual user I while look content relevant to their user number.
Because of the differing photo quantities between users, I am unsure of how to process the submitted form.
Is it possible to while loop content back into the database in order to update the table?
Code that produces form details:
while($row = mysql_fetch_array($result))
{
echo '<div style="width:180px; height:210px; float:left;"><img src="../assets/uploads/thumbnail_' . $row['photoLINK'] . '" alt="" class="profileImgsStretch"/>';
echo '<input type="text" name="caption' . $row['photoID'] . '" value="' . $row['photoCAPTION'] . '"></div>';
echo '<input type="hidden" name="picture" value="' . $row['photoID'] . '"></div>';
}

Answer 1

First you need to look at the structure of the database. if 1 user has many pictures you need to make a separate database table consisting of the user id and the photo id
your database structure should be like this
myDB
table 1 -Users
table 2 -user_and_picture
-user_id
-picture_id
table 3 -Pictures
You insert the new picture into the pictures table
Then retrieve that picture id
get the user id and the picture id and store it in the new table user_and_picture
When you want to retrieve the pictures that belong to lets say user 1 you run a query on table user_and_pictures
an example would be
SELECT user_id, user_picture_id
FROM user_and_picture
WHERE user_id = 1
The result of this query will give you all the pictures associated with user #1
after that make a query that gets the filenames of those pictures

Answer 2

In your html use:
<input type="text" name="caption[' . $row['photoID'] . ']" value="' . $row['photoCAPTION'] . '">
You may remove the hidden input field.
So that in your PHP file you may use:
$captions = $_GET['caption'];
foreach ($captions as $picture_id => $caption){
/*
VERY IMPORT TIP ABOUT HACKING: For each caption, check if the picture_id belongs to the user BEFORE making the update. Otherwise a hacker can just change the picture id's and add malicious captions for other users!
If the picture belongs to the uploading user, then continue.
*/
echo 'caption for picture_id: '.$picture_id.' = '.$caption.'<br />'
}

Answer 3

This is how form with data works:
your input field have element named name. its the variable name for your input which you receive in you back-end i.e PHP page.
the form variable name could be literal variable or could be an array.
so for example:
login:
<input type="text" name="username" />
<input type="text" name="password" />
to get it in PHP
$user = $_POST["username"];
$pass = $_POST["password"];
OR in array
<input type="text" name="loginData[username]" />
<input type="text" name="loginData[password]" />
to get it in PHP
$userData = $_POST["loginData"]; // $userData = Array(username, password)
OR
$user = $_POST["loginData[username]"];
$pass = $_POST["loginData[password]"];