How to update database in php? - php

Question

I wanna update my product when there's user login. Here's my code in edit.php
<?php
$id= (int)$_GET['id'];
$query = "SELECT * FROM game WHERE gameId=".$id."";
$rs = mysql_query($query);
while($data = mysql_fetch_array($rs))
{
?>
<form action="doUpdate.php" method="post">
<?php echo "<image src=\"images/".$id.".png\" alt=\"gameImage\" </image>"?>
<div class="cleaner"></div>
<div class="myLabel">Name</div><div>: <input type="text" value="<?php echo $data['gameName'];?>" name="gameName"/></div>
<div class="myLabel">Developer</div><div>: <input type="text" value="<?php echo $data['gameDeveloper'];?>" name="gameDeveloper"/></div>
<div class="myLabel">Price</div><div>: <input type="text" value="<?php echo $data['gamePrice'];?>" name="gamePrice"/></div>
<br/>
<div id="txtError" style="color:#D70005">
<?php
if(isset($err))
{
if($err==1) echo"All Fields must be filled";
else if($err==2) echo"Price must be numeric";
else if($err==3) echo"Price must be between 1-10";
}
?>
</div>
<input type="submit" value="Submit"/>
<input type="button" value="Cancel"/></span>
<?php
}
?>
</form>
This is my code in doUpdate.php
<?php
$nama = $_POST['gameName'];
$dev = $_POST['gameDeveloper'];
$harga =$_POST['gamePrice'];
$id= (int)$_REQUEST['id'];
if($nama == "" || $dev == "" || $harga == "" )
{
header("location:edit.php?err=1");
}
else if(!is_numeric($harga))
{
header("location:edit.php?err=2");
}
else if($harga < 1 || $harga >10)
{
header("location:edit.php?err=3");
}
else
{
$query = "UPDATE game SET gameName='".$nama."', gameDeveloper='".$dev."', gamePrice=".$harga." where gameId=".$id."";
mysql_query($query);
header("location:product.php");
}
?>
Why I can't change name, developer, or price even I already give the action in form? And why if I delete the name, developer, and price to know wether the validation works or not, it said that Undefined index in edit.php $id= (int)$_GET['id']; ?

Answer 1

You are trying to get $_REQUEST['id'] in doUpdate.php but there is no such field in the form.
You have to add it as a hidden field.
Also you have to format your strings.
Every string you're gonna put into query you have to escape special characters in.