Update SQL data within PHP

Question

Ok i have updated my Code, not getting any Errors but nothing is being updated on the mysql side nor on the PHP Front end.

I have even tried a Hard Coded Statment.

This section is at the Very top of my Php Viewer page..

<?php
/

    / IF RESQUEST IS EQUAL TO SUBMUIT
    if (isset($_REQUEST['submit']))
            {   
                $my_date = date("Y-m-d H:i:s");
                $order = uniqid();
                $FullName= $_REQUEST['fullname'];
                //Take in full Name and Split it into first and last name.
                list($fname, $lname ) = explode( ' ', $customerName, 2 );       
                $address = $_REQUEST['address'];
                $emailAddress = $_REQUEST['emailAddress'];
                $phoneNo = $_REQUEST['phoneNo'];


Below is my Sticky Forum which is getting the Information from the Database and putting it into the Text Fields 

    // STICKY FORM TO ALLOW USER TO UPDATE INFORMATION 
    if (isset($_REQUEST['up']))
        {
            $query_sticky = mysqli_query($connection,'SELECT * FROM orders WHERE id = "' . $_GET['id'] . '"');
            if(! $query_sticky )
    {
      die('Could not get data: ' . mysqli_error($connection)); // Could not find Order_id show Error
    }//end die error 
    else
        (isset($_REQUEST['update']));
        {
    while($row = mysqli_fetch_array($query_sticky, MYSQLI_ASSOC))
    {
        $row['id'];
        echo '<form action="" method="post">'

      Name:';
            echo'<input name="customerName" id="cname" type="text" required   value="'.$row['firstname']. " " .$row['lastname']. '" />';
           echo' <br/>
            <br/>
            Address:
           <textarea name="address" id = "caddress" type="text" rows="5" cols="30" required value="'.$row['address'].'" ></textarea>
            <br/>
            <br/>
            Email Address:
           <input name="emailAddress" type="email" required  value="'.$row['email']. '" />
            <br/>
            <br/>
            <br/>
            Phone Number:
             <input name="phoneNo" id="phoneNumber" type="text" required  value="'.$row['phone']. '" />
            <br/>
             <br/>
          <button type="submit" name="update" value="update" >update</button
      <div id="Submit">
        </form>
        <form action="order.php" method="delete">
        </form>';
    }//close if 
        }
    } // Close While 

here is my Update Section 

    if (isset($_REQUEST['update']))
    {
            $updateDB = "UPDATE orders SET student ='$_POST[student]', 
            firstname='John', lastname='wallace',
            email = '$_POST[emailAddress]', address = '$_POST[address]',
            phone = '$_POST[phoneNo]'
            WHERE 
            order_id ='$_GET[order_id]'";
            mysqli_query($connection, $updateDB);
        }//end update..     
        }//end PHP 
    ?>

Your code is open to [SQL injection](http://en.wikipedia.org/wiki/SQL_injection) exploits. Use [prepared statements](http://en.wikipedia.org/wiki/Prepared_statement). — Phylogenesis, Apr 02 '15 at 16:02
You can't use `mysql_error()` with `mysqli_query`. That is why you're getting "Could not update data: " but not seeing an error. — Digital Chris, Apr 02 '15 at 16:02
Shouldn't it be `$_POST['update']` instead of `$_REQUEST['update']`? — s3lph, Apr 02 '15 at 16:02
@the_Seppi either will work: http://php.net/manual/en/reserved.variables.request.php — Digital Chris, Apr 02 '15 at 16:04
Also, you probably don't want to be using `@$`: http://stackoverflow.com/questions/3551527/php-at-symbol-before-variable-name-post — Digital Chris, Apr 02 '15 at 16:07
Ok when i took out the @ symbol i am getting : ( ! ) Notice: Undefined variable... — Dave, Apr 03 '15 at 07:40

score 1 · Answer 1 · answered Apr 02 '15 at 16:09

1

You were mixing up single and double quotes in your UPDATE query string. Try this instead:

$updateDB = "UPDATE test
SET email = '".@$_POST[$emailAddress]."',
address = '".@$_POST[$address]."',
phone = '".@$_POST[$phoneNo]."'
WHERE id = '".$_GET['id']."'";

answered Apr 02 '15 at 16:09

Tim Biegeleisen

387,723
20
200
263

And mixing API's and suppressing errors. Other than that it is all good ¯\\_(ツ)_/¯ – Jay Blanchard Apr 02 '15 at 16:10
First time a SO comment has me LOL...but yes this PHP is raunchy and I don't need to eat an entire bar of butter to know that it's rancid. – Tim Biegeleisen Apr 02 '15 at 16:12

Update SQL data within PHP

1 Answers1