Question

I created a html form to enable users to update data. However the input data (array values) are not passed through to php SUBMIT, thus clicking SUBMIT does not update the table. When I go into the SUBMIT portion of the script and change the SET to specific numbers or text, the table is updated. Meaning that the values from the html input data array are not being passed through properly to the SUBMIT portion of the script. Any help appreciated.

<?php
//Mysql connection and initial select query placed above
?>

<table width="400" border="0" cellspacing="1" cellpadding="0">
<form name="Contacts" method="post" action="">
<tr> 
<td>
<table width="400" border="0" cellspacing="1" cellpadding="0">


<tr>
<td align="center"><strong>Id</strong></td>
<td align="center"><strong>Name</strong></td>
<td align="center"><strong>Lastname</strong></td>
<td align="center"><strong>Email</strong></td>
</tr>

<?php
while($rows=mysql_fetch_array($result)){
?>
<tr>
<td align="center"><?php $id[]=$rows['id']; ?><?php echo $rows['id']; ?></td>
<td align="center"><input name="name[]" type="text" id="name" value="<?php echo $rows['name']; ?>"></td>
<td align="center"><input name="lastname[]" type="text" id="lastname" value="<?php echo $rows['lastname']; ?>"></td>
<td align="center"><input name="email[]" type="text" id="email" value="<?php echo $rows['email']; ?>"></td>
</tr>
<?php
}
?>
<tr>
<td colspan="4" align="center"><input type="submit" name="Submit" value="Submit"></td>
</tr>
</table>
</td>
</tr>
</form>
</table>

<?php
// Check if button name "Submit" is active, do this 
if(isset($_POST['Submit'])){
$id=$_POST['id'];
$name=$_POST['name'];
for($i=0;$i<$num;$i++){
$sql1="UPDATE contacts SET name= ".$name[$i]." WHERE id= ".$id[$i]."";
$result1=mysql_query($sql1);
}
}

if($result1){
header("location:updated.php");
}
mysql_close();
?>

Thanks!

Answer 1

You are missing single quotes around your $name[$i] in the SQL statement. If id is not always numeric, you will also need to surround $id[$i] in single quotes.

$sql1="UPDATE contacts SET name= '".$name[$i]."' WHERE id= ".$id[$i]."";
//------------------------------^^^-----------^^^

Some error checking in your mysql_query() call would make this clearer. See below.

And you must filter these against SQL injection before passing them to the query.

for($i=0;$i<$num;$i++) {
  // Call mysql_real_escape_string() to sanitize these...
  $id[$i] = mysql_real_escape_string($id[$i]);
  $name[$i] = mysql_real_escape_string($name[$i]);

  $sql1="UPDATE contacts SET name= '".$name[$i]."' WHERE id= ".$id[$i]."";

  $result1 = mysql_query($sql1);
  // Error checking:
  if (!$result1) {
     echo mysql_error();
  }
}