Question

i have created a php file for update info in mysql db. it’ll get the input from a html form & then update data by matching ID. here is it:

<?
$con = mysql_connect("localhost","root","");
mysql_select_db("workshop", $con);
$sql = "UPDATE apply 
          SET staffname=' ".$_POST['name']." ', 
              staffno=' ".$_POST['contact']." ',
              staffemail=' ".$_POST['mail']." ',
              staffaddress=' ".$_POST['address']." ',
              paytype=' ".$_POST['paytype']."'
        WHERE 
            staffid=' ".$_POST['ic']." '";
$result = mysql_query($sql);
printf("Records updated: %d\n", mysql_affected_rows());
    if($result){
        echo "Successful";
}
    else {
        echo "ERROR";
}

mysql_close($con);
?>

its executing nicely but the problem is there is no effect on the table row. even i run the query on phpmyadmin but no luck! can anyone tell me where is the bug? thank you!

Answer 1

Use the below query:

$sql = "UPDATE `apply`
        SET `staffname` = '" . mysql_escape_string($_POST['name']) . "',
            `staffno` = '" . mysql_escape_string($_POST['contact']) . "',
            `staffemail` = '" . mysql_escape_string($_POST['mail']) . "',
            `staffaddress` = '" . mysql_escape_string($_POST['address']) . "',
            `paytype` = '" . mysql_escape_string($_POST['paytype']) . "'
        WHERE `staffid` = '" . mysql_escape_string($_POST['ic']) . "'";

EDIT

It is always better to use PDO or mysqli instead of mysql_* functions
but for now the above solution may work.