Mysql not updating [Resolved]

[Epiales]

Okay, I've spent a few hours trying to figure out why this isn't working. I can't find any errors visibly, and there are no errors displayed. So here I am lol....

Here is my isset function when they choose to update the information:

Code: Select all

$select = mysql_query("select * from locations LIMIT 1");

if(isset($_POST['update'])){
$UpdateQuery = "UPDATE locations SET location='$_POST[Location]', name='$_POST[Name]', price='$_POST[Price]', level='$_POST[Level]', greeting='$_POST[Greeting]', exitgreet='$_POST[ExitGreet]' WHERE id='$_POST[hidden]'";

mysql_query($UpdateQuery); 

Here is the input area that will be used for the isset:

Code: Select all

 <td>Location </td>
        <td><span class="div2">
          <input type="textarea" size="30" name="Location" id="Location" value= <?php echo $result['location'] ?> />
        </span></td>
        <td><!--DWLayoutEmptyCell-->  </td>
      </tr>
      <tr>

Here is the submit that will call the issset:

Code: Select all

 <?php echo '<input type=image value=Update image name=update img src="'  . '/adminpanelexample/images/user_edit.png">' ?>

Is it not working because of the limit one? I only want the first entry displayed is why I did it that way. Other than this, I have looked the code a billion times and find nothing wrong. Grrr Thx.

*EDITED* If you want to know the post hidden, here:

Code: Select all

<input type="hidden" name="hidden" id="edit5" value= "<?php echo $result['id'] ?>" />

[a_bertrand]

Beside your code like that is a HUGE security issue, I would simply print out the SQL you create and run it though phpmyadmin to show what's up.

[Epiales]

Beside your code like that is a HUGE security issue, I would simply print out the SQL you create and run it though phpmyadmin to show what's up.

Good idea...will do that...

[Epiales]

Well I thought I would

Fairly new to most of this. Getting a working game going first, and then tear through the code to work on security. It's enough just getting something going to begin with for a fairly new coder. The game is up and running, and got loads of features already. Just working on an admin panel and then fix a few bugs I've seen. Then hopefully I can post the game here and have a few of ya test her out and give input and advice. The whole designs going to be redone. I have someone doing the design and stuff for me, but don't like it lol. Seems kind of plain, but I am new at this afterall, so I can't complain.

Is still, for the likes of me, can't see why it won't work. I'll spend some more time messing with it and give up for awhile. Could be, that when I start something, it is VERY hard for me to stop doing it for any amount of time. I get going, and it's got to be done. Thanks for the advice

[a_bertrand]

Actually it's never a good idea to leave security for later, as it may mean the end of your site as soon as it's public. Also trying to fix things afterward means a lot more work.

So to avoid such cases as SQL injection, try to use MySQLi or PDO and bind variables. A good option is to use the class I made for it.

To avoid XSS check what htmlentities makes.

There is more security issues possible in a website but those 2 will already do some.

[Epiales]

What would be an example of using the htmlentities in the code I have displayed? If you don't mind?

[a_bertrand]

in your example: not possible as you don't have any output from the DB.... so that would make no sense.

[Epiales]

in your example: not possible as you don't have any output from the DB.... so that would make no sense.

Well I have the users information being output to a form, where I just enter the information into the form and then it goes back to the database. My whole admin section is setup that way.

[a_bertrand]

The admin section is not what I would consider the most dangerous place for XSS attacks.

[Epiales]

Well, all I can do is

It would help if I had it in a form LOL. I think I need sleep

*RESOLVED* lol

Now if my access levels were that easy LOL YAY