views:

60

answers:

6

I have a simple mysql_query() update command to update mysql.

When a user submits my form, it will jump to an update page to update the data. The problem is that there's supposed to be some data shown after the update, but it comes out blank.

My form

<form id="form1" method="POST" action="scheduleUpdate.php" >

  <select name=std1>
    <option>AA</option>
    <option>BB</option>
    <option>CC</option>
  </select>

  <select name=std2>
    <option>DD</option>
    <option>EE</option>
    <option>FF</option>
  </select>

.......//more drop down menu but the name is std3..std4..etc...
.......
</form>

scheduleUpdate.php

//$i is the value posted from my main app to tell me how many std we have

for($k=0;$k<$i;$k++){

    $std=$_POST['std'.$k];
//if i remove the updateQuery, the html will output.I know the query is the problem but i //couldn't fix it..
    $updateQuery=mysql_query("UPDATE board SET
                student='$std'
                WHERE badStudent='$std' or goodStudent='$std'",$connection);
        //no output below this line at all
        if($updateQuery){
        DIE('mysql Error:'+mysql_error());
        }

    }

// I have bunch of HTML here....but no output at all!!!!

MySQL will be updated after I hit submit, but it doesn't shown any HTML.

+3  A: 

Your error handling is wrong; $updateQuery evaluates to true on success, so you kill your program on success instead of on an error.

jeroen
+3  A: 

Should it not be:

if(!$updateQuery)

?

Ken Keenan
+1  A: 

Shouldn't you die only if the query fails:

if(!$updateQuery){
    die('mysql Error:'+mysql_error());
}
Mark Byers
+2  A: 

As others have said, it should probably be if(!$updateQuery){ rather than if($updateQuery){. I would have expected that you'd see the output "mysql Error:" though.

As an additional note, please read up on SQL injection and sanitising user input, as you appear to be writing vulnerable code.

Hammerite
The user only needs to select the value, they can't do inputs. Do I still need to worry about Sanitising data?
Jerry
Generally speaking, you should always sanitise anything that will go into a database query. Bear in mind that if I want, I can submit POST data to your page that I've generated myself, rather than using your page. That is to say, you can't rely on the POST data being in the "safe" format you designed.
Hammerite
+1  A: 

According to your sample form, you should start k at 1 in the for loop, not 0.

Marcus Adams
A: 

If You execute the code above you will get HTML output that saying "mysql Error:", also your counter variable k should start form one, since the first form element has name std1.

dobrisa.com