Page 1 of 1
Mysql not updating [Resolved]
Posted: Fri Aug 30, 2013 10:22 am
by Epiales
Okay, I've spent a few hours trying to figure out why this isn't working. I can't find any errors visibly, and there are no errors displayed. So here I am lol....
Here is my isset function when they choose to update the information:
Code: Select all
$select = mysql_query("select * from locations LIMIT 1");
if(isset($_POST['update'])){
$UpdateQuery = "UPDATE locations SET location='$_POST[Location]', name='$_POST[Name]', price='$_POST[Price]', level='$_POST[Level]', greeting='$_POST[Greeting]', exitgreet='$_POST[ExitGreet]' WHERE id='$_POST[hidden]'";
mysql_query($UpdateQuery);
Here is the input area that will be used for the isset:
Code: Select all
<td>Location </td>
<td><span class="div2">
<input type="textarea" size="30" name="Location" id="Location" value= <?php echo $result['location'] ?> />
</span></td>
<td><!--DWLayoutEmptyCell--> </td>
</tr>
<tr>
Here is the submit that will call the issset:
Code: Select all
<?php echo '<input type=image value=Update image name=update img src="' . '/adminpanelexample/images/user_edit.png">' ?>
Is it not working because of the limit one? I only want the first entry displayed is why I did it that way. Other than this, I have looked the code a billion times and find nothing wrong. Grrr Thx.
*EDITED* If you want to know the post hidden, here:
Code: Select all
<input type="hidden" name="hidden" id="edit5" value= "<?php echo $result['id'] ?>" />
Re: Mysql not updating
Posted: Fri Aug 30, 2013 10:33 am
by a_bertrand
Beside your code like that is a HUGE security issue, I would simply print out the SQL you create and run it though phpmyadmin to show what's up.
Re: Mysql not updating
Posted: Fri Aug 30, 2013 10:36 am
by Epiales
a_bertrand wrote:Beside your code like that is a HUGE security issue, I would simply print out the SQL you create and run it though phpmyadmin to show what's up.
Good idea...will do that...
Re: Mysql not updating
Posted: Fri Aug 30, 2013 10:50 am
by Epiales
Well I thought I would
Fairly new to most of this. Getting a working game going first, and then tear through the code to work on security. It's enough just getting something going to begin with for a fairly new coder. The game is up and running, and got loads of features already. Just working on an admin panel and then fix a few bugs I've seen. Then hopefully I can post the game here and have a few of ya test her out and give input and advice. The whole designs going to be redone. I have someone doing the design and stuff for me, but don't like it lol. Seems kind of plain, but I am new at this afterall, so I can't complain.
Is still, for the likes of me, can't see why it won't work. I'll spend some more time messing with it and give up for awhile. Could be, that when I start something, it is VERY hard for me to stop doing it for any amount of time. I get going, and it's got to be done.
Thanks for the advice
Re: Mysql not updating
Posted: Fri Aug 30, 2013 12:23 pm
by a_bertrand
Actually it's never a good idea to leave security for later, as it may mean the end of your site as soon as it's public. Also trying to fix things afterward means a lot more work.
So to avoid such cases as SQL injection, try to use MySQLi or PDO and bind variables. A good option is to use the class I made for it.
To avoid XSS check what htmlentities makes.
There is more security issues possible in a website but those 2 will already do some.
Re: Mysql not updating
Posted: Fri Aug 30, 2013 12:54 pm
by Epiales
What would be an example of using the htmlentities in the code I have displayed? If you don't mind?
Re: Mysql not updating
Posted: Fri Aug 30, 2013 1:11 pm
by a_bertrand
in your example: not possible as you don't have any output from the DB.... so that would make no sense.
Re: Mysql not updating
Posted: Fri Aug 30, 2013 2:15 pm
by Epiales
a_bertrand wrote:in your example: not possible as you don't have any output from the DB.... so that would make no sense.
Well I have the users information being output to a form, where I just enter the information into the form and then it goes back to the database. My whole admin section is setup that way.
Re: Mysql not updating
Posted: Fri Aug 30, 2013 2:25 pm
by a_bertrand
The admin section is not what I would consider the most dangerous place for XSS attacks.
Re: Mysql not updating
Posted: Fri Aug 30, 2013 6:18 pm
by Epiales
