submitting form data to MySQL Issue-CodePudding

i have a couble of forms to be submited to my database, i make a general function to update specified table, but the problem isthe code dos'nt modify database , it is only change the column (fullname) to zero here is my code bellow: please helpand great thanks:

<?php
include('../config.php');
if (isset($_POST['loginfo'])) {
    if (update_table('users','id =2 And password =12345')== true){
        echo "Success";
    }
}

//>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
function update_table($tablename,$creteria) {                                                       //>>>>
    $sql = "UPDATE ".$tablename. " set ";                                                               //>>>>
    $postdata = $_POST;                                                                                         //>>>>
    $count = 0;                                                                                                     //>>>>
    $i = 0;                                                                                                           //>>>>
    foreach ($postdata as $key => $value) {                                                             //>>>>
               $i  ;                                                                                                   //>>>>
               $count = count($postdata);                                                                     //>>>>
               if (!empty($value)) {                                                                            //>>>>
               $sql .= " $key = '$value' ";                                                                 //>>>>
               $sql .= $i == $count ? " " : " AND ";  }                                             //>>>>
    }                                                                                                                       //>>>>  
    $sql .= " where ". $creteria;                                                                             //>>>>
    $MYDB = mysqli_connect(DB_HOSTNAME, DB_USERNAME, DB_PASSWORD, DB_DATABASE); //>>>>      
    if (mysqli_query($MYDB, $sql)){                                                                         //>>>>      
            echo "<pre>";                                                                                             //>>>>
            print_r($postdata);                                                                                 //>>>>
            return true;                                                                                              //>>>>
        }                                                                                                                   //>>>>
    $MYDB -> close();                                                                                               //>>>>
}                                                                                                                           //>>>>
///>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

?>

<!DOCTYPE html>
<html>
<head>
<style>
table, th, td {
  border: 1px solid;
}
</style>
</head>
<body>
<form method="post">
    <input type="hidden" name="loginfo">
    <label for="id"> id </label>
    <input type="text" name="id">
    <label for="fullname"> Full Name </label>   
    <input type="text" name="fullname">
    <label for="email"> Email </label>  
    <input type="text" name="email">
    <label for="phone"> Phone </label>      
    <input type="text" name="phone">
    <label for="company"> Company </label>      
    <input type="text" name="company">
    <label for="password"> Password </label>    
    <input type="text" name="password">
    <input type="submit"> 
</form>

       
</body>
</html

CodePudding user response：

You have syntax error in generation SQL query with PHP. Firstly, it is not true that you used set condition with and .

You query is such now:

UPDATE users set id = '1' AND fullname = 'scdasd' AND email = 'sadasd' AND phone = 'sdasd' AND company = 'asdad' AND password = 'asdasd' where id =2 And password =12345

You need to change PHP script like this:


<?php
include('../config.php');
if (isset($_POST['loginfo'])) {
    if (update_table('users','id =2 And password =\'12345\'')== true){
        echo "Success";
    }
}

//>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
function update_table($tablename,$creteria) {                                                       //>>>>
    $sql = "UPDATE ".$tablename. " set ";                                                               //>>>>
    $postdata = $_POST;                                                                                         //>>>>
    $count = 0;                                                                                                     //>>>>
    $i = 0;                                                                                                           //>>>>
    foreach ($postdata as $key => $value) {                                                             //>>>>
        $i  ;                                                                                                   //>>>>
        $count = count($postdata);                                                                     //>>>>
        if (!empty($value)) {                                                                            //>>>>
            $sql .= " $key = '$value' ";                                                                 //>>>>
            $sql .= $i == $count ? " " : " , ";  }                                             //>>>>
    }                                                                                                                       //>>>>
    $sql .= " where ". $creteria;                                                                             //>>>>
   /* $MYDB = mysqli_connect(DB_HOSTNAME, DB_USERNAME, DB_PASSWORD, DB_DATABASE); //>>>>
    if (mysqli_query($MYDB, $sql)){                                                                         //>>>>
        echo "<pre>";                                                                                             //>>>>
        print_r($postdata);                                                                                 //>>>>
        return true;                                                                                              //>>>>
    }                                                                                                                   //>>>>
    $MYDB -> close();   */
    echo "$sql";                                                                                             //>>>>
    echo "<pre>";                                                                                             //>>>>
    print_r($postdata);                                                                                 //>>>>
    return true;   //>>>>
}                                                                                                                           //>>>>
///>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

?>

<!DOCTYPE html>
<html>
<head>
    <style>
        table, th, td {
            border: 1px solid;
        }
    </style>
</head>
<body>
<form method="post">
    <input type="hidden" name="loginfo">
   <!-- <label for="id"> id </label>
    <input type="text" name="id">-->
    <label for="fullname"> Full Name </label>
    <input type="text" name="fullname">
    <label for="email"> Email </label>
    <input type="text" name="email">
    <label for="phone"> Phone </label>
    <input type="text" name="phone">
    <label for="company"> Company </label>
    <input type="text" name="company">
   <!-- <label for="password"> Password </label>
    <input type="text" name="password">-->
    <input type="submit">
</form>


</body>
</html

After it, query will show like this:

UPDATE users set id = '1' , fullname = 'scdasd' , email = 'sadasd' , phone = 'sdasd' , company = 'asdad' , password = 'asdasd' where id =2 And password ='12345'