Update mysql via php form

[unre4l]

Hey,

I'm trying to make a schedule that can be updated on one page and then displayed on another. The only problem is the code for the update page isnt actually updating the sql database...

Could anyone take a look at this code and see where the problems are. (I'm new to php so ya)

<?
include("config.php");

if (!$_POST[update])
{
$schedule = mysql_query("SELECT * from schedule where day='Monday'");
$schedule = mysql_fetch_array($schedule);

echo("
<center><form method=\"POST\">
<table width=499>
<tr>
<td align=\"right\" width=\"25%\">
12am - 1am</td><td align=\"left\">
<input size=\"25\" name=\"twelveam\" value=\"$schedule[twelveam]\"></td>
</tr>


Lots more like this, removed them for space

<td align=\"right\" width=\"25%\">
11pm - 12am</td>
<td align=\"left\">
<input size=\"25\" name=\"elevenpm\" value=\"$schedule[elevenpm]\"></td>
</tr>
<tr>
<td align=\"center\">
</td>
<td align=\"left\">
<input type=\"submit\" name=\"update\" value=\"Update\"></td>
</tr>
</table>
</form>
</center>");
}
else
{
$twelveam = htmlspecialchars($_POST[twelveam]);
$oneam = htmlspecialchars($_POST[oneam]);
$twoam = htmlspecialchars($_POST[twoam]);
$threeam = htmlspecialchars($_POST[threeam]);

echo ("Monday has been updated.");
$update = mysql_query("update schedule set twelveam = '$twelveam',
oneam = '$oneam', twoam = '$twoam', threeam = '$threeam', fouram = '$fouram', fiveam = '$fiveam', sixam = '$sixam', sevenam = '$sevenam', eightam = '$eightam', nineam = '$nineam', tenam = '$tenam', elevenam = '$elevenam', twelvepm = '$twelvepm', onepm = '$onepm', twopm = '$twopm', threepm = '$threepm', fourpm = '$fourpm', fivepm = '$fivepm', sixpm = '$sixpm', sevenpm = '$sevenpm', eightpm = '$eightpm', ninepm = '$ninepm', tenpm = '$tenpm', elevenpm = '$elevenpm' where day = 'Monday'");

}
}
else
{
// They aren't logged in!
echo ("<a href=\"login.php\">You must login</a>");
}
?>

Hope someone can help.

Cheers

[gavinandresen]

First: you've gotta quote array indices, so do:

if ($_POST['update']) ...

$twelveam = htmlspecialchars($_POST['twelveam']);

(note the ' characters inside the square brackets).

Second, I'd separate the display of the form from the PHP code; I like to use the output buffering functions (ob_start()/ob_end_flush()) to grab the HTML for the form into a string, and have all the PHP logic at the end.

Third, I'd take a more "data-driven" approach to save typing.

I'd code it something like this:

[code]<?

$times = array(
'twelveam' => '12am - 1am',
... lots removed...
'elevenpm' => '11pm - 12am',
);

ob_start();

?>
<center><form method="POST">
<table width=499>
<?php
foreach ($times AS $name => $value) {
?>
<tr>
<td align="right" width="25%">
<?php echo $value; ?></td><td align="left">
<input size="25" name="<?php echo $name; ?>"></td>
</tr>
<?php
} // End of foreach $times
?>
<tr>
<td align="center">
</td>
<td align="left">
<input type="submit" name="update" value="Update"></td>
</tr>
</table>
</form>
</center>
<?php
$formHTML = ob_end_flush();

// You can download fillInFormValues from: http://www.skypaint.com/gavin/code/
require_once("fillInFormValues.php");

if (!$_POST[update])
{
  $schedule = mysql_query("SELECT * from schedule where day='Monday'");
  $schedule = mysql_fetch_array($schedule, MYSQL_ASSOC);

  echo fillInFormValues($formHTML, $schedule);
}
else {
  // Build up UPDATE sql:
  $setClause = "";
  foreach ($times AS $name => $value) {
    $setClause .= "$name = '".htmlspecialchars($_POST[$name])."',";
  }
  // Trim off trailing comma:
  $setClause = rtrim($setClause, ',');
echo ("Monday has been updated.");
$update = mysql_query("update schedule set $setClause where day = 'Monday'");

}
}
else
{
// They aren't logged in!
echo ("<a href=\"login.php\">You must login</a>");
}
?> [/code]

[unre4l]

I dont think that will work for what i want it to do.

The new version doesnt connect to the database at all, so it wont be able to update it.

I'd have two pages, the one to show the information from the mysql database and the one to update the database information.

One would be a form that when you submit the form data it replaces the mysql record information with the updated version. Thats what the html form was for.