Question

Having trouble getting my form to UPDATE records in my database even after searching the web and viewing the other answers on stack-overflow.

Here is my current NON functioning code:

if ((isset($_POST["MM_update"])) && ($_POST["MM_update"] == "form1")) {

session_start();
$tablename = $_SESSION['MM_Username'];
$amount=$_POST['amount'];
$UpdateQuery = "UPDATE '" . $tablename . "' SET stock = '" . $amount . "' WHERE status = 1";
mysql_query($UpdateQuery);

}

The table i want to update has the same name as the SESSION variable MM_Username. I have a form with a textbox named amount and a Submit button that when clicked, should trigger the above code. If you need to know anything else let me know. Thanks in advance!

Answer 1

You’re using the wrong quotes around your table name. Also, your query is open to SQL injection. Consider using PDO and bind parameters.

$UpdateQuery = sprintf('UPDATE `%s` SET `stock` = :amount WHERE `status` = 1',
                       $tablename);
$stmt = $pdo->prepare($UpdateQuery);
$stmt->bindParam('amount', $amount);
$stmt->execute();