Update Database Not Working

[Amit_Yaron]

@coxdabd

Hi all, I have a small script that should process the data from a previous page and enter it into the database and then redirect the user. It is redirecting the user but not updating the information in the database. Any thoughts or ideas would be appreciated as always!

<?php 
//Controls Edit section submit button!
if(isset($_POST['subit'])){
	$blip = preg_replace('/[^0-9\\.]/', '', $product['price']); 
		$total = $blip*$product['quantity'];
			$updateData = mysql_query("UPDATE order_products SET product_name='$_POST[prodname]' WHERE id='$_GET[row]'");
				header('Location: ../orderhistory-test.php?section=view&id='.$_GET['id'].'&ref='.$_GET['ref'].'');
}	
?>

I think it doesn’t work because the variables in the string are array subscripts. The PHP engine fails to interpret variables such as ‘$_GET[row]’ and ‘$_POST[prodname]’. Try moving those variables to string variables as follows:
$prodname = $_POST[‘prodname’];
$row = $_GET[‘row’];

[SpacePhoenix]

Using $_GET, $_POST, etc instead of $_REQUEST makes the code slighly more self-documenting as you can see straight away, where your getting the value from, be it a session ($_SESSION), a cookie ($_COOKIE), a query string ($_GET) or a form ($_POST) but when you use $_REQUEST it’s not immediately obvious where your getting the value from.

[rpkamp]

@SpacePhoenix

Using $_GET, $_POST, etc instead of $_REQUEST makes the code slighly more self-documenting as you can see straight away, where your getting the value from[s], be it a session ($_SESSION)[s], a cookie ($_COOKIE), a query string ($_GET) or a form ($_POST) but when you use $_REQUEST it’s not immediately obvious where your getting the value from.

$_SESSION is not a part of $_REQUEST

But what you’re saying is very true. The security vulnerability is that $_COOKIE is also in there. See http://devlog.info/2010/02/04/why-php-request-array-is-dangerous/

[arusdevelopers]

Check the form tag. Are you using action=“get” or post.

You are using both of them. It is not correct.

I think your code is not iterating below statement
<?php //Controls Edit section submit button!

if(isset($_POST[‘subit’])){

regards,
USman Munir
<snip/>