Jump to content
samanj

Updating the timestamp error

Recommended Posts

Hi,

I have a php form that submits updated 'comments' onto specific records.

I have now added a timestamp feature to record the time of submission automatically.

I have only added the lines and sections containing 'sent' (which is the column that for the timestamp) but there is an error when I do this and the php file shows an error as a result.

$hospitalnumber = $_POST['hospitalnumber'];
   $PIN = $_POST['PIN'];
   $comments = $_POST['comments'];
   $sent = date("Y-m-d H:i:s");

   // mysql query to Update data
   $query = "UPDATE `greencard` SET `comments`= '$comments', 'sent' = '$sent' WHERE `hospitalnumber`= '$hospitalnumber' and `PIN`= '$PIN'";

I have tested the timestamp coding and it has worked on other php files I made so I am confused as to what is wrong.

Also, the overall code works when I remove 'sent' = '$sent' and $sent = date("Y-m-d H:i:s"); (but obviously without updating the timestamp).

Any help appreciated as always.

Share this post


Link to post
Share on other sites

Before dealing with this, you need to change to using prepared statements. Because as your code is now, someone could submit malicious data into your form and completely screw up everything in your database.

Not sure whether you're using PDO or mysqli, but both of them support it. Switch now. It might even fix your problem, too.

Share this post


Link to post
Share on other sites
1 hour ago, requinix said:

It might even fix your problem, too.

Unlikely :)

Quotes need removing...

$query = "UPDATE `greencard` SET `comments`= '$comments', 'sent' = '$sent' WHERE `hospitalnumber`= '$hospitalnumber' and `PIN`= '$PIN'";
                                                          ^    ^

and it's easier just to use

... sent = NOW() WHERE ...

  • Like 1
  • Great Answer 1

Share this post


Link to post
Share on other sites
5 minutes ago, Barand said:

Unlikely :)

Shh.

  • Haha 1

Share this post


Link to post
Share on other sites

This is one of the reasons I don't use bactics around column names unless they are absolutely necessary (wihich is rare).

$query = "UPDATE greencard SET comments = '$comments', sent = '$sent' WHERE hospitalnumber = '$hospitalnumber' and PIN= '$PIN'";

 

Quote

Before dealing with this, you need to change to using prepared statements. Because as your code is now, someone could submit malicious data into your form and completely screw up everything in your database.

Make sure that follow Requinix's instructions and change this code to use parameters and prepared statements.  There is no excuse to write new code this way! 

 

Share this post


Link to post
Share on other sites

Thank you everyone for your guidance and support.

I do have a long way to go before getting to grips with this programming language so all input is gladly taken. :) 

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.