0

I am trying to update a data in a table which has 5 fields. The fields are the following: proj_name, cust_name, address, cost and details.

Here is my code for the update (update_orde.php):

 <?php
 include("connect.php");
 // get value of id that sent from address bar
 $id=$_GET['id'];
 // Retrieve data from database
 $sql="SELECT * FROM project WHERE id='$id'";
 $result=mysql_query($sql);

 $rows=mysql_fetch_array($result);
 ?>
 <table width="400" border="0" cellspacing="1" cellpadding="0">
 <tr>
 <form name="form1" method="post" action="update_orde_suc.php">
 <td>
 <table width="100%" border="0" cellspacing="1" cellpadding="0">
 <tr>

 <td colspan="5"><strong>Update Data</strong> </td>
 </tr>
 <tr>
 <td align="center"><strong>Project Name</strong></td>
 <td align="center"><strong>Customer</strong></td>
 <td align="center"><strong>Address</strong></td>
 <td align="center"><strong>Cost</strong></td>
 <td align="center"><strong>Details</strong></td>
 </tr>
 <tr>
 <td><input name="pn" type="text" id="pn" value="<? echo $rows['proj_name']; ?>"></td>
 <td align="center"><input name="cn" type="text" id="cn" value="<? echo $rows['cust_name']; ?>" size="15"></td>
 <td align="center"><input name="add" type="text" id="add" value="<? echo $rows['address']; ?>" size="15"></td>
 <td><input name="cost" type="text" id="cost" value="<? echo $rows['cost']; ?>" size="15"></td>
 <td><input name="details" type="text" id="details" value="<? echo $rows['details']; ?>" size="15"></td>
 </tr>
 <tr>
 <td align="center" colspan="5"><input name="id" type="hidden" id="id" value="<? echo $rows['id']; ?>">  <input type="submit" name="Submit" value="Submit"></td>
 </tr>
 </table>
 </td>
 </form>
 </tr>
 </table>


 <?

 // close connection
 mysql_close();

 ?>

and here's the successful insertion into the database (update_orde_suc.php):

<?php
include("connect.php");
$id=$_POST['id'];
$pn = $_POST['proj_name'];
$cn = $_POST['cust_name'];
$add = $_POST['address'];
$cost = $_POST['cost'];
$det = $_POST['details'];

// update data in mysql database
$sql="UPDATE project SET proj_name='$pn', cust_name='$cn',address='$add', cost='$cost', details='$det' WHERE id='$id'";
$result=mysql_query($sql);

// if successfully updated.
if($result){
echo "Successful";
echo "<BR>";
echo "<a href='orders_edit.php'>View result</a>";
}

else {
echo "ERROR";
}

?>

The problem is that when I try to change the data there is an error that says the 3 first indexes of update_orde_suc.php are undefined (cost and details are ok).

The weirdest thing is that I used the exact same code for another table update and it worked just fine, the only thing i did now was to change the names of the variables to correspond to the names of the new table.

Brian Tompsett - 汤莱恩
  • 5,753
  • 72
  • 57
  • 129
ekptwtos
  • 101
  • 2
  • 11
  • It looks to me that your SQL is vurnerable for injection. Read some about it here http://www.unixwiz.net/techtips/sql-injection.html or other sites – bart s May 29 '12 at 10:49
  • You call the fields `pn`, `cn` and `add` in the form so naturally `proj_name`, `cust_name` and `address` are not there. – JJJ May 29 '12 at 10:50
  • 1
    The first thing you should do in cases like this is to add `print_r( $_POST )` and check what the form actually sends. – JJJ May 29 '12 at 10:51
  • the 3 first variables give no values... but the cost and details return the value thats inserted in the table. Maybe the problem is in the update_orde.php then? i should look into it again! – ekptwtos May 29 '12 at 12:53

1 Answers1

3

You mixed up the variables badly. For example you save the proj_name coming from input as $pn and later when you are inserting it in the database you use $proj_name. You have to stick with the variable names throughout the code to work.

slash197
  • 9,028
  • 6
  • 41
  • 70