Question

I need a form that allows a user to edit data from an SQL database.

The main page of my form contains a table where any available data is shown and, also, there are edit and delete options available. Sample:

{
$row=mysql_fetch_array($result);
echo "<tr>";
echo "<td>".$row["name"]."</td>";
echo "<td>".$row["occuptation"]."</td>";
echo '<td><a href="edit.php"><img src="edit.png"/></a></td>';
echo '<td><a href="delete.php"><img src="delete.png"/></a></td>';
echo "</tr>";
}

When the user clicks the edit.png I need it to direct to edit.php where the data from the whole row selected (whichever row the user chooses to click edit or delete from) shows up in a form (like default values). I have no idea how to achieve this.

Any help is appreciated! Please tell me if i’m being confusing and I will try to explain further.

Answer 1

What you’ll want to do is include an identifier as a query string parameter in the edit and delete links:

echo '<td><a href="edit.php?id=' . $row["id"] . '"><img src="edit.png"/></a></td>';
echo '<td><a href="delete.php?id=' . $row["id"] . '"><img src="delete.png"/></a></td>';

(Of course, I’m assuming the name of your identifier. But you get the idea.)

This will tell those pages which record they should display. The pages would get the identifier with:

$_GET["id"]

A few things you’ll want to consider:

• Make sure to check for a proper identifier value in $_GET["id"] before you try to do anything with it. Never assume it’s valid without checking.
• DO NOT simply concatenate the value into a SQL string. Use something like PDO to build queries with parameters. What you’re trying to avoid here is something called a SQL injection vulnerability.
• Make sure the user is permitted to access the record in question for the operation in question (edit or delete) before you display anything. Never assume that the link came directly from something your code output on a page. Anybody can just as easily manually change the id value in the URL.