Help with an update query?

[7724]

Hi All,

Wondering if anyone can help me. I have a html table which I want to use to update in a query.

<?php
if(isset($_POST['Submit']))
  {

    for($i = 0; $i < count($_REQUEST['the_text']); $i++)
  {
    $result = mysql_query("Update tbl set text ='".$_REQUEST['the_text'][$i]."' WHERE topstory_id=".$_REQUEST['id'][$i]) OR DIE(mysql_error());
   print "Update tbl  set text ='".$_REQUEST['the_text'][$i]."' WHERE topstory_id ='".$_REQUEST['id'][$i]."'";
  }

  header("Location: done.php");

   } 
?>
<form id="form" action="" method="post"  name="form">
   <table  align="center">
      <thead>
        <tr> 
          <th>Position</th>
          <th>Make Position</th>
        </tr>
      </thead>
      <tbody>
                <tr>
          <td><input type="hidden" name="id[]" value="21">Panel ()</td>
          <td><input style="margin-top:20px;" type="checkbox" name="the_text[]" value="AND story_id = 1234"></td>
        </tr>
                <tr>
          <td><input type="hidden" name="id[]" value="22">Panel ()</td>
          <td><input style="margin-top:20px;" type="checkbox" name="the_text[]" value="AND story_id = 1234"></td>
        </tr>
              </tbody>
    </table>
   <button type="submit" name="Submit" value="Submit">Submit</button>
  </form>

And basically what I do is tick ONE of the checkboxes which updates my mysql database. So depending on what I tick and hit submit with the query should be either:

Update tbl set text ='AND story_id = 1234' WHERE topstory_id ='21'
or
Update tbl set text ='AND story_id = 1234' WHERE topstory_id ='22'

But nomatter what checkbox I tick in the table and press submit with it always sets the query as

Update tbl set text ='AND story_id = 1234' WHERE topstory_id ='21'

Anyone help?
Thanks

[Shrapnel_N5]

You should never pass query parts from user input.

[djjjozsi]

set the checkbox name tag as:
name="the_text[X]" where X is the primary key of you table

And the update:

<?php

foreach( $_POST["id"] AS $ids ) {
    if ( isset( $_POST["the_text"][$ids] ) ) {
        $sql = sprintf( "update table SET field='%s' WHERE topstory_id=%d " , mysql_real_escape_string( $_POST["the_text"][$ids] ) , $ids );
        echo $sql; // if its good, use the mysql_query()
    } 
} 

?>

[7724]

Thanks Guys

You should never pass query parts from user input.

Out of interest why?

[spikeZ]

because it leads you open to MASSIVE sql injection.

Imagine I made a form and sent it to YOUR processing that had something like:

AND delete where 1=1

bish bash bosh there goes your database!

[paul_wilkins]

You should never pass query parts from user input.

Could you advise the OP as to how it should be handled instead?