MYSQL update through PHP form

[Codethat]

I'm building a website where i want to change a value in the database directly from a php form.

 

Statement i want to send the database: UPDATE people SET name='VALUE FROM TEXTFILED' WHERE id=1

 

How do i integrate this statement into a php form textfield?

[Eiolon]

Your text field should have a value.  When you process the form, use that value in your update statement where you have "VALUE FROM TEXTFIELD".

[shlumph]

Ok, you'll do something like this:

<?php
//$_POST['name'] corresponds to the textfield named "name"
if($_POST['name']) {

    //DB Credentials
    $host = "localhost";
    $user = "root";
    $pass = "";

    //Connect to the database
    $con = mysql_connect($host, $user, $pass) or die(mysql_error());
    mysql_select_db("db_name") or die(mysql_error());
    
    $name = mysql_real_escape_string($_POST['name']);

    $sql = "UPDATE people SET name='{$name}' WHERE id=1";
    mysql_query($sql) or die(mysql_error());

    echo "UPDATED! Whooooohooo";

}

?>

<form action="" method="post">
     <input type="text" name="name" />
     <input type="submit" />
</form>

 

Obviously, this is spaghetti code, but it will help get you started!

[Codethat]

When using that code i get the this error,

 

Notice: Undefined index for this line  $name = mysql_real_escape_string($_POST['name']);

 

And the form dont work, it just delete the text in the database.

 

Please help!

[shlumph]

1. It's not an error, it's a notice. I guess you could either turn off notices, or do this:

if(isset($_POST['name']))  {
    //rest of code
}

 

2. How don't the form work?

 

3. It's definitely not deleting anything from your database.

[Codethat]

Okay it now works fine to change the value via the form, thanks. But i dont want to give the users right to type in any value they want so i added the following preg_match.

 

if(isset($_POST['Cstring'])){
if(!preg_match("/^[a-z]$/",$_POST['Name'],$Estring)){
echo "Error";
    }  

 

When typing in anything other then whats allowed i get the error msg but the form still sends the information. What am i missing or doing wrong?

[shlumph]

You get the error message because that is all you are doing in the condition you created. You need to nest the query (and connection information) to the database in the condition that states it can only be alphanumeric characters.

 

I'd suggest you read up conditional statements. You need to learn to crawl before you can walk, buddy