Home/ Questions/Q 4344996
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-21T11:58:33+00:00

I’ve created a form to update the banner info on my website. Everything seems

  • 0

I’ve created a form to update the banner info on my website. Everything seems to update except the input that is typed into the “textarea” called “desc”. The code looks right and it is driving me insane.

Thanks in advance.

<html>
<body>



<form action="aupdate.php" method="POST" enctype="multipart/form-data">

    Your or your company's name:<br>
    <input type="text" name="com" size="60"><br>


    URL:<br>
    <input type="text" name="url" size="80"><br>


    Please enter the username that you will use to update your advertisement info:<br>
    <input type="text" name="user" size="80"><br>

    Please enter the password that you will use to update your advertisement info:<br>
    <input type="text" name="pass" size="80"><br>

   <br>
   <br>


<br>
    File:<br>
    <input type="file" name="image">

          advertisement description:<br>

 <textarea name="desc" id="desc" cols="35" rows="5" ></textarea>

      <input type="submit" value="update your ad!">


    </form>

<?php

//connect to database
require("connect.php");

//get user made username
$user = $_POST['user'];

//get user made password
$pass = $_POST['pass'];

//encrypt user made password
$encpass = hash('sha256', $pass);

//file properties
$file = $_FILES['image']['tmp_name'];

//initialize company name and description
$com = $_POST['com'];
$desc = $_POST['desc'];
$url = $_POST['url'];




//check to see if coupon code and other essential info entered
if (!$user || !$pass )
{
    echo "Please enter updated info with username and password.";
}
else
{

//retrieve data from password table
$query = mysql_query ("SELECT * FROM apartment WHERE pass = '$encpass' ");

//get number of rows in table
$numrows = mysql_num_rows ($query);

//check if code is right or exists
if ($numrows !=0)
{

    // code to login
    while ($row = mysql_fetch_assoc ($query))
    {
        //retrieve code from database to match with the code that was put into field
        $dbuser = $row['user'];
        $dbpass = $row['pass'];
    }

    //check to see if they match
    if ($user == $dbuser && $encpass == $dbpass )
    {


    //check to see if a file has even been submitted
    if (!$file)
    {

        echo "please upload image";
    }
    else
    {
        //get image file attributes
    $image = addslashes(file_get_contents ($_FILES['image']['tmp_name']));
    $image_name = addslashes($_FILES['image']['name']);
    $image_size = addslashes(getimagesize($_FILES['image']['tmp_name']));

    //check if image file size is right
    if ($image_size==FALSE)
        echo "that's not an image.";
    else
    {


mysql_query ("UPDATE apartment SET desc = '$desc' WHERE user ='$user'"); 
mysql_query ("UPDATE apartment SET name = '$image_name' WHERE user ='$user'"); 
mysql_query ("UPDATE apartment SET com = '$com' WHERE user ='$user'"); 
mysql_query ("UPDATE apartment SET url = '$url' WHERE user ='$user'"); 
mysql_query ("UPDATE apartment SET image = '$image' WHERE user ='$user'"); 


            echo "advertisement successfully updated!";



    }
  }


}
else


    echo "Incorrect username or password.";
}
else 



    echo "Incorrect username or password.";

}

?>
</body>
</html>
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    desc is mysql reserved word enclose it in backticks

    and escape user input with mysql_real_escape_string

        $desc=mysql_real_escape_string($desc);
    mysql_query ("UPDATE apartment SET `desc` = '$desc' WHERE user ='$user'");

    You could also improve your update queries to update in once using comma to separate fields in update query

    mysql_query ("UPDATE apartment SET `desc` = '$desc',url='$url' WHERE user ='$user'");
    • 0