-1

i'm pretty new to PHP and HTML programming (so I apologise in advanced if this is a stupid question) and have been trying to figure out how to get the ID (Of which the user had previously entered into the database) and put it as the value of the input box in another php file. I am creating a book 'storage' system and am trying to figure out how to Edit & Update a row.

Here is the edit.php file, for the user to select which row to edit:

<html>
<head>
    <meta charset = "utf-8">
    <link rel="stylesheet" type="text/css" href="Hnav.css">
</head>
<body>
<ul>
  <li><a href="index.php">Home</a></li>
  <li><a href="ar.php">Add data</a></li>
  <li><a href="drNew.php">Delete data</a></li>
  <li><a class="active" href="ur.php">Edit & Update </a></li>
  
</ul>

 <?php // connect.php allows connection to the database

  require 'connect.php'; //using require will include the connect.php file each time it is called.

 // SELECT DAYA FROM BOOK TABLE IN DATBASE  
  
  $query  = "SELECT * FROM myTable";
  $result = $conn->query($query);
  if (!$result) die ("Database access failed: " . $conn->error);

  $rows = $result->num_rows;

print<<<_HTML
  
  <p> Here is your Books list </p>
    
    <table id = "book_table">
          <tr>
            <th>Book id</th>
            <th>Title</th>
            <th>Author</th>
            <th>Action</th>
          </tr>
_HTML;
 
 if ($result->num_rows >0)
            {
            while($row = $result->fetch_assoc()) 
                {
                        echo "<tr>";
                        echo "<td>".$row["id"]."</td>";
                        echo "<td>".$row["title"]."</td>";
                        echo "<td>".$row["author"]."</td>";
                        ?>
                        <td><a href="edit.php?edit=<?php echo $row['id']; ?>"
                            class="btn btn-info">Edit</a></td>
                        <?php
                        
                                
                        echo "</tr>";
                }
            } 
            else 
            {
                echo "0 results";
            }

print<<<_HTML
 </table>
    <br>
    <a href="index.php" target="_self"> <p>Home</p></a> 
_HTML;
    
    $result->close();
    $conn->close(); 
    
    if (isset($_GET['edit'])){
        $id = $_GET['id'];
        $result = $mysqli->query("SELECT * FROM myTable WHERE id=$id") or die($mysqli->error());
        if (count($result)==1){
            $row = $result->fetch_array();
            $title = $row['title'];
            $author = $row['author'];
        }
    }       
?> 

</body> 
</html>

I want to take the value of the ID for the row of the Edit button which is pressed and put it as the value of the ID text box in update.php:

<html>
<head>
    <meta charset = "utf-8">
    <link rel="stylesheet" type="text/css" href="Hnav.css">
</head>
<body>
<ul>
  <li><a href="index.php">Home</a></li>
  <li><a href="ar.php">Add data</a></li>
  <li><a href="drNew.php">Delete data</a></li>
  <li><a class="active" href="ur.php">Edit & Update </a></li>
  
</ul>

<?php // connect.php allows connection to the database

  require 'connect.php'; //using require will include the connect.php file each time it is called.
    
  $query  = "SELECT * FROM myTable";
  $result = $conn->query($query);
  if (!$result) die ("Database access failed: " . $conn->error);

  $rows = $result->num_rows;

print<<<_HTML
  
  <p> Here is your Books list </p>
    
    <table id = "book_table">
          <tr>
            <th>Book id</th>
            <th>Title</th>
            <th>Author</th>
          </tr>
_HTML;
 
 if ($result->num_rows >0)
            {
            while($row = $result->fetch_assoc()) 
                {
                        echo "<tr>";
                        echo "<td>".$row["id"]."</td>";
                        echo "<td>".$row["title"]."</td>";
                        echo "<td>".$row["author"]."</td>";
                        
                                
                        echo "</tr>";
                }
            } 
            else 
            {
                echo "0 results";
            }

    if (
        isset($_POST['title']) &&
        isset($_POST['author'])
        )
        
      
  {
    $id     = $_POST['id'];
    $title  = $_POST['title'];
    $author = $_POST['author'];
    

    $query    = "UPDATE `myTable` SET `id` = '$id', `title` = '$title', `author` = '$author' WHERE id='$id'";
    
    $result   = $conn->query($query);
    if (!$result) echo "<br><br>UPDATE failed: $query<br>" .
    
      $conn->error . "<br><br>";
  }
?>


  <form action="  " method="post">
    
    Book id: <input type="text" name="id" value="<?php echo $row['id']; ?>" required> <br><br> //This is where I'm trying to put the row ID into
    Book title: <input type="text" name="title" placeholder="Enter the Title" required> <br><br>
    Author name: <input type="text" name="author" placeholder="Enter the Author" required> <br><br>
      
    <input type="submit" value="UPDATE RECORD"><br><br>
    
   </form>

<?php  
  
  
  function assign_data($conn, $var)
  {
    return $conn->real_escape_string($_POST[$var]);
  }
  
  
  ?>
  
</body>
</html>

Any help would be greatly appreciated

  • You are open to SQL injections. Use prepared statements and parameterize the query. Don't bother with the `assign_data` function. In `name="id" value=""` where do you expect the id to come from? It is in GET isn't it? – user3783243 May 26 '22 at 20:07
  • **Warning:** You are wide open to [SQL Injections](https://php.net/manual/en/security.database.sql-injection.php) and should use parameterized **prepared statements** instead of manually building your queries. They are provided by [PDO](https://php.net/manual/pdo.prepared-statements.php) or by [MySQLi](https://php.net/manual/mysqli.quickstart.prepared-statements.php). Never trust any kind of input! Even when your queries are executed only by trusted users, [you are still in risk of corrupting your data](http://bobby-tables.com/). [Escaping is not enough!](https://stackoverflow.com/q/32391315) – Dharman May 26 '22 at 23:13

0 Answers0