Mysql script to update values using php

Question

I have a code here that I use and whenever I run it, It runs without error but it does not update the values inside Mysql.

Kindly advice what's wrong.

Thanks.

Here's the code.

<?php
session_start();
$loginuser = $_SESSION['result'];
$con=mysqli_connect("localhost","root","","leavecalendar");
// Check connection
if (mysqli_connect_errno())
  {
  echo "Failed to connect to MySQL: " . mysqli_connect_error();
  }
if ('$_POST[department]' == 'Shared') {
  //$sql="UPDATE `employee` SET `leavecount` = '$_POST[lbalance]', sickleave = 1 WHERE        `department` = '$_POST[department]'";
  $sql = "UPDATE `employee` SET `leavecount` = 6.44, sickleave = 5 WHERE `department` =       \'Shared\'";
echo ($sql);
if (!mysqli_query($con,$sql))
 {
 die('Error: ' . mysqli_error($con));
 }
echo "1 record added";

 }

header("location:manageemployeeleaves.php");
mysqli_close($con);
?>

remove quotes on $_POST on if ('$_POST[department]' == 'Shared') — user1978142
– user1978142, Commented Jun 2, 2014 at 23:40
You will be wide open to SQL injection. Please use prepared statements and parameterize your queries — danronmoon
– danronmoon, Commented Jun 2, 2014 at 23:47

user1978142 · Accepted Answer · 2014-06-02 23:44:12Z

1

On your current code, remove the quotes on '$_POST[department]', as it is interpreted as a simple string. Consider this example:

<?php

session_start();
$loginuser = $_SESSION['result'];
$con=mysqli_connect("localhost","root","","leavecalendar");
// Check connection
if(mysqli_connect_errno()) {
    echo "Failed to connect to MySQL: " . mysqli_connect_error();
}

if($_POST['department'] == 'Shared') {
    $sql = "UPDATE `employee` SET `leavecount` = '6.44', sickleave = 5 WHERE `department` = 'Shared'";
    if(!mysqli_query($con,$sql)) {
        die('Error: ' . mysqli_error($con));
    }
}

mysqli_close($con);    
header("Location: manageemployeeleaves.php");

?>

Note: Since your are using mysqli, it is advisable to use mysqli_stmt::bind_param instead of directly using your variables inside the query statement.

answered Jun 2, 2014 at 23:44

user1978142

7,9683 gold badges19 silver badges20 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Roi patrick Florentino Over a year ago

Thank you so much for the advice. If I may ask what is mysql injection by the way and how is it so bad?

user1978142 Over a year ago

@Patrick eto bro check mo, straight from the manual

Roi patrick Florentino Over a year ago

Sir Kevin may post akong bago baka po pwede pa check po kung tama yung gawa ko po.

Collectives™ on Stack Overflow

Mysql script to update values using php

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related