damndionic360 Posted November 21, 2016 Share Posted November 21, 2016 I am having issues with a php page i'm working on I have a list.php which is recalling data from a mysql database, a config.php as a connection page to my db. Below is my edit.php page and when i view it, its completely blank. Where is my code gone wrong? URL string http://localhost/example/edit.php?id=382 (which should be recalling the client id of 382 to edit)` <html> <body> <?php include('config.php'); if(isset($_GET['cx_id'])) { $id=$_GET['cx_id']; if(isset($_POST['submit'])) { $name=$_POST['Name']; $address=$_POST['Address']; $query3=mysqli_query("update restrictedkeys set Name='$name', Address='$address' where cx_id='$id'"); if($query3) { header('location:list.php'); } } $query1=mysqli_query("select * from restrictedkeys where cx_id='$id'"); $query2=mysqli_fetch_array($query1); ?> <form method="post" action=""> Name:<input type="text" name="name" value="<?php echo $query2['Name']; ?>" /><br /> Address:<input type="text" name="address" value="<?php echo $query2['Address']; ?>" /><br /><br /> <br /> <input type="submit" name="submit" value="update" /> </form> <?php } ?> </body> </html> Thank you for your help! Quote Link to comment Share on other sites More sharing options...
Barand Posted November 21, 2016 Share Posted November 21, 2016 (edited) You need to turn error reporting on. Preferably in your php.ini file but if not possible put this at top of the script error_reporting(E_ALL); ini_set('display_errors', 1); mysqli_query requires the connection as its first parameter. With error reporting on it would have told you. You also need exit; after a header redirect to stop other code in the page from executing. PS If error reporting is on, the redirect may be hiding the message. Edited November 21, 2016 by Barand Quote Link to comment Share on other sites More sharing options...
benanamen Posted November 22, 2016 Share Posted November 22, 2016 (edited) He has more problems than that. The code is vulnerable to an SQL Injection Attack. You NEVER EVER send user supplied data directly to the database. I could delete his entire database in 2 seconds. The query naming 123 is ridiculous and confusing. There are only two queries yet he has query #3? Edited November 22, 2016 by benanamen Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.