Edit MySQL Row Using PHP and HTML Form

[CrownVictoriaCop]

Hello,

 

Here's what I'm trying to do. Build a page where a user enters a MySQL row number in. Then, a new page appears with an HTML form where the user can edit the information in that row. Like for example, there's an input field for name, address, phone, etc. How would I possibly do this? I tried looking online, but nothing is working for me.

 

Anthony

[Garethp]

Search:

 

<form action="Show.php">
Row Number: <input type="text" name="Row">
<input type="submit">
</form>

 

Show.php"

<?php

//Database Login Details here

if(isset($_POST['Row']))
{
$Row = mysql_real_escape_string($_POST['Row']);

$Search = mysql_select("SELECT * FROM `table` WHERE `ID`='$Row'");
$Search = mysql_fetch_assoc($Search);

echo "<form action=\"\" method=\"post\">
ID: <input type=\"text\" name=\"RowID\"><br>";

foreach($Search as $k=>$v)
	{
	echo "$k: <input type=\"text\" name=\"$k\" value=\"$v\"><br>";
	}

echo "<input type=\"submit\" value=\"Edit\">";
}

if(isset($_POST['RowID']))
{
$RowID = mysql_real_escape_string($_POST['RowID']);
foreach($_POST as $k=>$v)
	{
	if($k == "submit" || $k == "RowID")
		{
		continue;
		}

	$k = mysql_real_escape_string($k);
	$v = mysql_real_escape_string($v);

	mysql_query("UPDATE `table`
	SET `$k`='$v'
	WHERE ID='$RowID'");
	}
}
?>

 

Just enter your login details, and if it doesn't work, under $Search = mysql_fetch_assoc($Search); add $Search=$Search[0]; as a test

 

I haven't tested this, and I probably won't

[Gayner]

mysql_Realescape that..

[Garethp]

Where am I missing an escape? I thought I used real escape on all my inputs

[CrownVictoriaCop]

Nothing shows up on the results page.

[code]<?php

$dbhost = 'localhost';
$dbuser = 'safetyfi_secure';
$dbpass = 'hidden';

$conn = mysql_connect($dbhost, $dbuser, $dbpass) or die                      ('Error connecting to mysql');

$dbname = 'safetyfi_students';
mysql_select_db($dbname);

if(isset($_POST['Row']))
   {
   $Row = mysql_real_escape_string($_POST['Row']);

   $Search = mysql_select("SELECT * FROM Students WHERE `ID`='$Row'");
   $Search = mysql_fetch_assoc($Search);

   echo "<form action=\"\" method=\"post\">
   ID: <input type=\"text\" name=\"RowID\"><br>";

   foreach($Search as $k=>$v)
      {
      echo "$k: <input type=\"text\" name=\"$k\" value=\"$v\"><br>";
      }

   echo "<input type=\"submit\" value=\"Edit\">";
   }

if(isset($_POST['RowID']))
   {
   $RowID = mysql_real_escape_string($_POST['RowID']);
   foreach($_POST as $k=>$v)
      {
      if($k == "submit" || $k == "RowID")
         {
         continue;
         }

      $k = mysql_real_escape_string($k);
      $v = mysql_real_escape_string($v);

      mysql_query("UPDATE `table`
      SET `$k`='$v'
      WHERE ID='$RowID'");
      }
   }
?>