Question

I’m using the following code to update a record. Bad thing is that it’s not updating a record but it’s adding a new record.

What am I doing wrong? I want it to update the record and not create a now one.

My modify url looks like this: http://randomsite.com/modify.php?id=1

Modify.php code:

<?php
    require_once("connect.php");

    $query = "SELECT * FROM cars WHERE id = :id";

    $result = $odb->prepare($query);
    $result->execute(array(':id' => $_REQUEST['id']) );

    while  ($row = $result->fetch(PDO::FETCH_ASSOC)) { ?>


    <h1>Modify a car</h1>
    <form  action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
    Brand:      <input type="text" name="brand" value="<?php echo $row['brand']; ?>"  /><br />
    Model:      <input type="text" name="model" value="<?php echo $row['model']; ?>"  /><br />
    Year:       <input type="text" name="year"  value="<?php echo $row['year'];  ?>"   /><br />
    ID:     <input type="text" name="id"  value="<?php echo $row['id'];  }?>"   /><br />
    <input type="submit" value="Modify" />
    </form>

    <?php

    if(isset($_POST['submit'])) {
    $id    = $_POST['id'];
    $brand = $_POST['brand'];
    $model = $_POST['model'];
    $year  = $_POST['year'];
    $q     = "UPDATE cars WHERE id = $_GET[id] (id, brand, model, year) VALUES(:id, :brand, :model, :year)";
    $query = $odb->prepare($q);
    $results = $query->execute(array(
            ":id"    => $id,
            ":brand" => $brand,
            ":model" => $model,
            ":year"  => $year,
    )); 
}
?>

Answer 1

Your SQL should look something more like this:

   $q = "UPDATE cars SET 
          id = :id, 
          brand = :brand, 
          model = :model, 
          year = :year 
          WHERE id = :oldid";

    $query = $odb->prepare($q);
    $results = $query->execute(array(
            ":id"    => $id,
            ":brand" => $brand,
            ":model" => $model,
            ":year"  => $year,
            ":oldid" => $_GET['id'],
    ));

As a side note, try not to put variables in your SQL (like your $_GET[‘id’]), part of the idea of using PDO is to avoid doing that.