Updating a pages content

[wrathican]

hey im using a form to update the content of a page on my website.

 

i have a table with 3 cols, id, title and content

a form with 3 fields. id(hidden), title(input) and content(textarea)

i have three pages that i want to be able to change the content and titles of.

 

here is the form:

<form name="editcont" action="/functions/adminfunctions.php?func=editpage" method="post">
	Page Title:<br />
	<input type="text" name="title" value="<?php echo $pageTitle; ?>" /><br />
	Page Content:<br />
	<textarea name="content" rows="15" cols="60"><?php echo $pageContent; ?></textarea>
	<input type="hidden" name="id" value="<?php echo $pageId; ?>" /><br />
	<input type="submit" name="edit" value="Edit" />
	</form>

 

and here is the processing script:

$id = $_POST['id'];
$title = $_POST['title'];
$content = nl2br($_POST['content']);

$query = "UPDATE won_content SET cont_title='".$title."', cont_content='".$content."' WHERE cont_id='".$id."'";
$result = query($query);

if($result) {

	//update was successful
	$_SESSION['errorstate'] = 1;
	$errorarray[] = "Thank you. The page you selected has been updated.";
	$_SESSION['errormessage'] = $errorarray;
	header('Location: ../admin/index.php');

}else{

	$_SESSION['errorstate'] = 1;
	$errorarray[] = "Sorry, but the page you tried to edit could not be edited right now. Please try again later.";
	$_SESSION['errormessage'] = $errorarray;
	header('Location: ../admin/index.php');

}

 

i can update pages 1 and 2, but the script throws my "Sorry, but the page you tried to edit could not be edited right now. Please try again later." error when i try an update page 3.

 

why is this happening?

[lemmin]

I would bet that you have a bad character in the content of that page, like a quote or single quote. That would break your SQL syntax and cause it to fail. Have your query show the error if it fails.

[Stooney]

Try running variables that will be used in sql queries though mysql_real_escape_string().  It's also great for security.

 

$title = mysql_real_escape_string($_POST['title']);