mysql php updating multiple entries through populated drop down menu - php

Question

I'm having an issue trying to update multiple entries in my database via a php populated drop down menu. Here is the code on my page that populates the table showing me all entries currently in my database:
$result = mysqli_query($con,"SELECT * FROM Submissions");
echo "<table border='1'>
<tr>
<th>First name</th>
<th>Last name</th>
<th>Email</th>
<th>Title</th>
<th>Text</th>
<th>Public Post OK?</th>
<th>Date/Time Submitted</th>
<th>Approved?</th>
<th>Test Approved</th>
</tr>";
while($row = mysqli_fetch_array($result))
{
echo "<tr>";
echo "<td>" . $row['fname'] . "</td>";
echo "<td>" . $row['lname'] . "</td>";
echo "<td>" . $row['email'] . "</td>";
echo "<td>" . $row['title'] . "</td>";
echo "<td>" . nl2br($row['text']) . "</td>";
echo "<td>" . $row['publicpost'] . "</td>";
echo "<td>" . $row['time'] . "</td>";
echo "<td><select name=\"approved\"><option value=\"" . $row['approved'] . "\">" . $row['approved'] . "</option><option value=\"yes\">Yes</option><option value=\"no\">No Again</option></select></td>";
echo "<td>" . $row['approved'] . "</td>";
echo "</tr>";
}
echo "</table>";
?>
<br><br>
<form action="update.php" method="post">
<input type="submit" name="SubmitButton" value="Update" class="submit" style="cursor:pointer;">
</form>
<?php
mysqli_close($con);
?>
This is the php code for "update.php":
$approved = $_POST['approved'];
mysqli_query($con,"UPDATE Submissions SET approved = $approved");
$update_query= "UPDATE Submissions SET approved = '$approved'";
if(mysqli_query($con,$update_query)){
echo "updated";}
else {
echo "fail";}
?>
<form action="approvesubmissions.php">
<input type="submit" value="Approve Submissions page">
</form>
The goal is to have the ability to update the field "approved" with a drop down menu from "NO" to "YES" or vice versa. Instead, what is happening with this query, is that it is erasing the data in the "approved" field instead of updating it. I'm somewhat new to php and i have researched a TON on this and have come up with no solutions. Any help is GREATLY appreciated!

Answer 1

First, let's assume 'approved' is a TINYINT(1) or something.
Your select html should be more like this. It will autofill based on the DB value.
$selected = 'selected="selected"'; // pre-selection attribute
$isApproved = !!$row['approved']; // is this active? (approved is 1 or 0)
echo '<select name="approved">
<option value="1" ' . ($isApproved ? $selected : '') . '>Yes</option>
<option value="0" ' . (!$isApproved ? $selected : ''). '>No</option>
</select>';
Secondly, your form is at the bottom of the table, but your input that you want is in the table. When you submit your form, there is no $_POST['approved'], because that's technically not in a form. To fix, you'll need to put your opening form tag at the top before the table. Then, you'll want to put your submit button and closing form tag at the end, after you've echoed the table out.
Thirdly, your post.php page should NOT ever take user input directly into a query. But, simply do this:
// Convert input to boolean answer, then int (for the query).
$approved = isset($_POST['approved']) ? (int)!!$_POST['approved'] : 0;
mysqli_query($con,"UPDATE Submissions SET approved = '$approved'");
While we're on the topic, this would be a great time to jump into prepared statements for your project. It might sound scary, but it can save you from SQL injection.
// Make the prepared statement
$query = mysqli_prepare("UPDATE Submissions SET approved = ?");
// Safely bind your params
mysqli_stmt_bind_param($query, "i", $approved);
// Run it
mysqli_stmt_execute($query);
// "close" the statement (hint: it's reusable for things like bulk updates, etc)
mysqli_stmt_close($query);