Question

Right, I hope this is the last problem on this particular project –
Its a personal diary project, the code in the index page echoes the menu bar with all the days, a div for the post and a div that contains a slider of images.

I have two databases, one is pages and the other is images they both have column called “pageorder” that helps me specify which images go to which page.

Now these images have a title and description, it all works!

The next part is the interface, I have made a page to CRUD the pages and to CRUD the images, the pages one works perfectly fine and CRUDs the database entries. However the images one will not update even though the echo message displays “Databse updated” without giving me errors so I think there is something wrong in my code.

<?php 

include_once "scripts/connect_to_mysql.php";

$pid = preg_replace("/[^0-9]/", "/[^a-z]/", $_POST['pid']); // filter everything but numbers for security

$sqlCommand = "SELECT * FROM images WHERE pageorder='$pid' ORDER BY id ASC"; 
$query = mysql_query($sqlCommand) or die (mysql_error());
$imageedit = ''; 
while ($row = mysql_fetch_array($query)) {
    $id = $row["id"]; 
    $images = $row["images"];
    $title = $row["title"];
    $desc = $row["description"];
    $pageorder = $row["pageorder"];

    $imageedit .= "<table width='300'>
    <tr>$id</tr>
    <tr><img src='$images' width='204' height='153' /></tr>
    <tr><textarea name='title' id='title' cols='30' rows='1'>$title</textarea></tr>
    <tr><textarea name='description' id='description' cols='60' rows='1'>$desc</textarea></tr>
    <tr>$pageorder</tr> </table>";
} 
mysql_free_result($query); 
?>

and the form details

<form id="form" name="form" method="post" action="administrator/page_images_parse.php"  onsubmit="return validate_form ( );">
<?php print $imageedit ?>
<input type="submit" name="button" id="button" value="Submit Page Edit" />
<input name="pid" type="hidden" value="<?php echo $pid; ?>" />
  </form>

When I go to my edit_index.php page that will ask me what page I want to edit, I tell it the number e.g. 1 and it will grab all the images associated with page 1. There are 18 images on page one when I update any title or description data it will not go into the database.

So I think there is a problem in the “page_images_parse.php”

The Code:

<?php

include_once "../scripts/connect_to_mysql.php";


$pid = $_POST['pid'];
$title = $_POST['title'];
$desc = $_POST['description'];


$query = mysql_query("UPDATE images SET title='$title', description='$desc' WHERE pageorder='$pid'") or die (mysql_error());

echo 'Operation Completed Successfully! <br /><br /><a href="index.php">Click Here</a>';
exit();
?>

I think there is a problem with the WHERE pageorder=’$pid’ function, but I have tried various things but nothing seems to be working.

P.S. I know about php injection but don’t need it for this project as it is offline, personal and no one else will see it!

Answer 1

instead of:

$pid = preg_replace("/[^0-9]/", "/[^a-z]/", $_POST['pid']);

you can use

 $pid = (int) $_POST['pid'];

also filter the data against mysql injection

$query = mysql_query("SELECT * FROM images WHERE pageorder='".mysql_real_escape_string($pid)."' ORDER BY id ASC") or die (mysql_error());

EDIT:

update the while loop as:

 $i=0;
 while ($row = mysql_fetch_array($query)) {
     $id = $row["id"]; 
     $images = $row["images"];
     $title = $row["title"];
     $desc = $row["description"];
     $pageorder = $row["pageorder"];

     $imageedit .= "<table width='300'>
     <tr>$id</tr>
     <tr><img src='$images' width='204' height='153' /></tr>
     <tr><textarea name='title[".$i."]' id='title[".$i."]' cols='30' rows='1'>$title</textarea></tr>
     <tr><textarea name='description[".$i."]' id='description[".$i."]' cols='60' rows='1'>$desc</textarea></tr>
     <tr>$pageorder</tr>
    <input type='hidden' name='id[".$i."]' value='".$id."' />
    </table>";
    $i++;
 } 

and page_images_parse.php as

 foreach ($_POST['id'] as $key => $id)
 {
    $pid = $id;
    $title = $_POST['title'][$key];
    $desc = $_POST['description'][$key];
    $query = mysql_query("UPDATE images SET title='$title', description='$desc' WHERE id='$pid'") or die (mysql_error());
 }