tags:

views:

56

answers:

2

I have this code to load the month of the birthday that corresponds to the id number:

<

?php $query = "SELECT DISTINCT BIRTHDAY FROM student WHERE IDNO='".$_GET['id']."'";
    if($result = mysql_query($query))  {


          if($success = mysql_num_rows($result) > 0) {
?>

                <select title="- Select Month -" name="mm" id="mm" class="" > 


    while ($row = mysql_fetch_array($result))
           list($year,$month,$day)=explode("-", $row['BIRTHDAY']);
             ?> 
             <option value="<?php echo $month;?>"><?php echo $month; ?></option>\n";

And this is the form action:

$birthday = mysql_real_escape_string($_POST['mm']); 

mysql_query("UPDATE student SET YEAR = FIRSTNAME='$fname',  BIRTHDAY='$birthday'
WHERE IDNO ='$idnum'");

What should I do, when I click on the update button, it executes, but I see the undefined offset error is stored in the mysql database and not the month. I'm just a beginner, can you give me some tips on how can I achieve updating the data

A: 

Hi,

Check your update query, It may be wrong in that.

mysql_query("UPDATE student SET YEAR = FIRSTNAME='$fname',  BIRTHDAY='$birthday'
WHERE IDNO ='$idnum'");

See this year and firstname, in this year is assigned to null character for you.

Just assign like this,

$birthday = $_POST['mm'];
Karthik
NO! BAD! `mysql_real_escape_string` is a must! SQL injection! Don't ignore best practices!
mattbasta
hi mattbasta, shall i know what type of sql injection it will got?
Karthik
Any time you put raw data from the user (i.e.: `$_GET`, `$_POST`, etc.) directly into a MySQL query without running it through `mysql_real_escape_string`, there's a chance that a hacker can hack your database and cause large amounts of damage. Always always always use `mysql_real_escape_string`.
mattbasta
Oh really. Ok thanks mattbasta. I didnt use that if some times i use mysql_real_escape_string i will get error. why it is? would you know that.
Karthik
+1  A: 

In cases like this... you will have to use 3 selects and then join them to update the database... so, in the form you have something like this:

<select name='month'>
    <option value='1'>January</option>
    <option value='xx'>etc</option>
</select>
<select name='day'>
    <option value='1'>1</option>
    <option value='xx'>etc</option>
</select>
<select name='year'>
    <option value='1980'>1980</option>
    <option value='xx'>etc</option>
</select>

Then... the PHP that receives that data should do something like:

$birthday = $_REQUEST['year'].'-'.$_REQUEST['month'].'-'.$_REQUEST['day'];
mysql_query("UPDATE student SET YEAR = FIRSTNAME='$fname',  BIRTHDAY='$birthday'
WHERE IDNO ='$idnum'");

Of course... you have to verify first whether all variables are set or not. You can do so by using the isset method.

Cristian