I am trying to implement the correct update code. I have a registration script which enables someone to create an account but I am now trying to create a page which allows someone to add details to their account. Do I simply change “INSERT INTO” to “UPDATE”.
What Im confused about is how I mix Post with string update to help make it secure.
The current code I have does update all the accounts so now I am trying to update each account matching it with the id (the field is id) however when I try to add this id function it creates an error.
function mysql_real_escape_array($t)
{
return array_map("mysql_real_escape_string",$t);
}
function trim_array($ar)
{
return array_map("trim",$ar);
}
if(isset($_POST['form_id']))
{
$_POST = mysql_real_escape_array($_POST);
$_POST = trim_array($_POST);
$error = "";
if(!isset($_POST['category']) || empty($_POST['category'])) {
$error = "Please select a category.";
}
if(!isset($_POST['website']) || empty($_POST['website'])) {
$error.= " Please enter a Website Domain.";
}
if(!isset($_POST['company']) || empty($_POST['company'])) {
$error.= " Please enter a Company Name.";
}
if(!isset($_POST['building']) || empty($_POST['building'])) {
$error.= " Please enter a Building Name or Number.";
}
if(!isset($_POST['streetname']) || empty($_POST['streetname'])) {
$error.= " Please enter a Street Name.";
}
if(!isset($_POST['town']) || empty($_POST['town'])) {
$error.= " Please enter your Town.";
}
if(!isset($_POST['state']) || empty($_POST['state'])) {
$error.= " Please enter a State.";
}
if(!isset($_POST['postcode']) || empty($_POST['postcode'])) {
$error.= " Please enter a Zip Code/Post Code.";
}
if(!isset($_POST['country']) || empty($_POST['country'])) {
$error.= " Please select your country.";
}
if(!isset($_POST['aboutcompany']) || empty($_POST['aboutcompany'])) {
$error.= " Please enter details about your company.";
}
if($error == "")
{
$sql = "
UPDATE
users
SET
category = '".$_POST['category']."',
linkcategory = '".str_replace(' ', '-',strtolower($_POST['category']))."',
firstname = '".$_POST['firstname']."',
surname = '".$_POST['surname']."',
email = '".$_POST['email']."',
website = '".$_POST['website']."',
company = '".$_POST['company']."',
building = '".$_POST['building']."',
streetname = '".$_POST['streetname']."',
town = '".$_POST['town']."',
state = '".$_POST['state']."',
postcode = '".$_POST['postcode']."',
aboutcompany = '".$_POST['aboutcompany']."',
country = '".$_POST['country']."'";
$result = mysql_query($sql) or die("An error occurred ".mysql_error());
}
Im confused but what you mean. I am using if ($_SESSION[‘userLoggedIn’]) to check if someone is logged in. How do I detect the user number of the member?
$id = (id) $_POST['form_id'];
function mysql_real_escape_array($t)
{
return array_map("mysql_real_escape_string",$t);
}
function trim_array($ar)
{
return array_map("trim",$ar);
}
if(isset($_POST['form_id']))
{
$_POST = mysql_real_escape_array($_POST);
$_POST = trim_array($_POST);
$error = "";
if(!isset($_POST['category']) || empty($_POST['category'])) {
$error = "Please select a category.";
}
if(!isset($_POST['website']) || empty($_POST['website'])) {
$error.= " Please enter a Website Domain.";
}
if(!isset($_POST['company']) || empty($_POST['company'])) {
$error.= " Please enter a Company Name.";
}
if(!isset($_POST['building']) || empty($_POST['building'])) {
$error.= " Please enter a Building Name or Number.";
}
if(!isset($_POST['streetname']) || empty($_POST['streetname'])) {
$error.= " Please enter a Street Name.";
}
if(!isset($_POST['town']) || empty($_POST['town'])) {
$error.= " Please enter your Town.";
}
if(!isset($_POST['state']) || empty($_POST['state'])) {
$error.= " Please enter a State.";
}
if(!isset($_POST['postcode']) || empty($_POST['postcode'])) {
$error.= " Please enter a Zip Code/Post Code.";
}
if(!isset($_POST['country']) || empty($_POST['country'])) {
$error.= " Please select your country.";
}
if(!isset($_POST['aboutcompany']) || empty($_POST['aboutcompany'])) {
$error.= " Please enter details about your company.";
}
if($error == "")
{
$sql = "
UPDATE
users
SET
category = '".$_POST['category']."',
linkcategory = '".str_replace(' ', '-',strtolower($_POST['category']))."',
firstname = '".$_POST['firstname']."',
surname = '".$_POST['surname']."',
email = '".$_POST['email']."',
website = '".$_POST['website']."',
company = '".$_POST['company']."',
building = '".$_POST['building']."',
streetname = '".$_POST['streetname']."',
town = '".$_POST['town']."',
state = '".$_POST['state']."',
postcode = '".$_POST['postcode']."',
aboutcompany = '".$_POST['aboutcompany']."',
country = '".$_POST['country']."',
WHERE id=$id";
$result = mysql_query($sql) or die("An error occurred ".mysql_error());
}
}
Well I used $id as an example, because most developers use a unique id for each row of a table – you do not have to.
How else is the database supposed to know which row is to be updated?
If you do have an id in this table, then you could be setting that id number to the SESSION variable when someone successfully logged in.
//user logs in succesfully;
$_SESSION['userLoggedIn'] = true; // you must be doing similar to this elsewhere
// so now add this
$_SESSION['userLoggedInId'] = 23; // or whatever unique identifier you have
// .. later ...
// retrieved and inserted into the sql string
// (int) is used to typecast the incoming variable to an integer
// just in case someone it trying on an SQL injection attack
// rest of sql statement, plus
WHERE id = " . (int) $_SESSION['userLoggedInId'] ;
When the user successfully logs in don’t just analyse “logged in” == true or false but grab that users ID.
Then go to where you create the session.
As you are starting the session assign the variable containing the user ID to a named session variable, to re-use @kduv; example:
$_SESSION['userID'] = the variable containing id number of the user.
…
then later, when the user updates, your sql can contain that SESSION variable, which will contain the users ID if you have done this properly.
HINT: use var_dump($_SESSION) to see what these vars contain when things go wrong. Its very easy to incorrectly assume what SESSION holds – in particular whether it is a string or an integer or boolean etc
An error occurred You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘WHERE id = bob’ at line 18
But I dont know how to turn ‘bob’ into the actually id number of the member.