Editing gone wrong

[mayman212]

Hi

I have a list created using php and mysql linked together. I have an edit and a delete button which edits and deletes data on the database.

When I click edit it brings up current information and I can change it, which is fine. But I click to edit it in the database it changes all the records I have in the database!!! Instead of the specific record!!!!

 

Could anybody please help!!!!

[mayman212]

Here is the code by the way:

 

<?php

 

if ((!isset($_GET['id']) || trim($_GET['id']) == ''))

{

die('Missing record ID!');

echo "<a href='display.php'>List</a>";

}

 

$con= mysql_connect('localhost','root','')

or die ('Unable to connect!');

 

mysql_select_db("project1", $con);

 

$id= $_GET['id'];

 

mysql_query("UPDATE project_data SET Date_Of_Birth='".$_POST[dateofbirth]."',Gender='".$_POST[gender]."',Title='".$_POST[title]."',First_Name='".$_POST[firstname]."',Last_Name='".$_POST[surname]."',Address_Line_1='".$_POST[address1]."',Address_Line_2='".$_POST[address2]."',City='".$_POST[city]."',Postcode='".$_POST[postcode]."',Contact_No='".$_POST[contactno]."',Email='".$_POST."',Additional_Comment='".$_POST[note]."'") or die ("Error in query: $query. " . mysql_error());

 

mysql_close($con);

 

echo 'Data Has Been Successfuly Updated.';

echo '<a href=display.php>Go Back</a>';

?>

[Muddy_Funster]

Of course it does, you have no WHERE statement in your UPDATE to specify that you only want a single record updated.

[mayman212]

Sorry anyone have any idea where to put the WHERE statement....My mind has gone blank!!

[Muddy_Funster]

at the end

[flappy_warbucks]

As a side note:  Read a book about PHP security and application design, and also touch up on your mysql.

 

However, the query should be:

 

"UPDATE project_data SET 
Date_Of_Birth='".$_POST[dateofbirth]."',
Gender='".$_POST[gender]."',
Title='".$_POST[title]."',
First_Name='".$_POST[firstname]."',
Last_Name='".$_POST[surname]."',
Address_Line_1='".$_POST[address1]."',
Address_Line_2='".$_POST[address2]."',
City='".$_POST[city]."',
Postcode='".$_POST[postcode]."',
Contact_No='".$_POST[contactno]."',
Email='".$_POST[email]."',
Additional_Comment='".$_POST[note]. "' where { ENTER YOUR CONDITIONS HERE (i.e. where username='". $_POST['username']. "') });"

 

Also look into uses of mysql_real_escape_string() and add_slashes().

 

Putting data directly into a database query is asking for trouble.

[AyKay47]

Sorry anyone have any idea where to put the WHERE statement....My mind has gone blank!!

this should help.. http://dev.mysql.com/doc/refman/5.0/en/where-optimizations.html