MySQL UPDATE changes all rows instead of WHERE

[RADaugherty]

So I pass header data to a PHP file and execute an UPDATE statement based on that. The header data comes through correctly but instead of updating it via the WHERE it just updates all rows.

 

Can someone tell me what I'm doing wrong?

 

The header data will look like this: Battery-0975GJ

<?php

include "config.php";

    if (isset($_GET['Header'])){

            $headerData =$_GET['Header'];
            $headerDataB = explode("|", $headerData);
            if (is_array($headerDataB)) {
                $headerData = $headerDataB[0] . " " . $headerDataB[1];
            }
            
            
            $contentVar = "True";

    $conn=mysqli_connect($host,$user,$password,$dbname);
      if(!$conn){
          die('Could not Connect MySql Server:' .mysql_error());
        }

$headerData = str_replace(['+', '<', '>', '(', ')', '~', '*', '\'', '"'], '', $headerData);
echo $headerData;

$sql="UPDATE ServicePending SET Tag = ? WHERE SystemID = ? ";
$stmt=$conn->prepare($sql);
$stmt->bind_param("si",$contentVar,$headerData);
$stmt->execute();


//                  echo '<script type="text/javascript">';
//echo 'alert("Battery has been updated!");';
//echo 'window.location.href = "attentionbatteries.php";';
//echo '</script>';

}

?>

 

Added in the echo $headerData; just for testing and uncommented the javascript section until I get this figured out.

 

SystemID is 100% unique after the "Battery-" but since I'm not doing a LIKE I can't figure out why its updating more than just that one with the SystemID found in the header data.

 

Thanks!

[mac_gyver]

when i tried your code, $headerData being used when the query is executed is the full 'Battery-0975GJ' value. this is a string, not an integer. you are casting it as an integer in the bind_param("si" usage, resulting in a zero for a value. in sql queries, when one parameter in a comparison is a number, the other parameter is converted to a number as well. you are getting WHERE 0 = 0 which is matching every row.

 

 

[RADaugherty]

6 minutes ago, mac_gyver said:

when i tried your code, $headerData being used when the query is executed is the full 'Battery-0975GJ' value. this is a string, not an integer. you are casting it as an integer in the bind_param("si" usage, resulting in a zero for a value. in sql queries, when one parameter in a comparison is a number, the other parameter is converted to a number as well. you are getting WHERE 0 = 0 which is matching every row.

 

 

Oh damn! So just changing that to an "s" for a string should fix my issue!

 

 

 

I knew it had to be something simple. Thanks a lot!