Question

This is my php code:

if (isset($_POST['data']) && is_array($_POST['data'])) {
                foreach ($_POST['data'] as $row => $data) {
                    $result = mysql_query("UPDATE orders SET project_ref='".$data['project_ref']."' where order_id = '".$data['order_id']."'") or die(mysql_error());
                    $result1 = mysql_query("UPDATE orders SET supp_short_code='".$data['supp_short_code']."' where order_id = '".$data['order_id']."'") or die(mysql_error());
                    $result2 = mysql_query("UPDATE orders SET om_part_no='".$data['om_part_no']."' where order_id = '".$data['order_id']."'") or die(mysql_error());
                    $result3 = mysql_query("UPDATE orders SET description='".$data['description']."' where order_id = '".$data['order_id']."'") or die(mysql_error());
                    $result4 = mysql_query("UPDATE orders SET quantity='".$data['quantity_input']."' where order_id = '".$data['order_id']."'") or die(mysql_error());
                    $result5 = mysql_query("UPDATE orders SET cost_of_items='".$data['cost_of_items']."' where order_id = '".$data['order_id']."'") or die(mysql_error());
                    $result6 = mysql_query("UPDATE orders SET cost_total='".$data['cost_total_td']."' where order_id = '".$data['order_id']."'") or die(mysql_error());
                }
            }

So when the user wants to edit order id: 1, i hope it will update all rows where the order_id is 1, but what this code is doing is setting all fields to “1”??

EDIT:

This is how i’m sending the data to the PHP:

$('#submit').live('click',function(){               
                    var postData = {};
                    postData['data[order_id]'] = $('#order_id').text();
                    $('#items tr').not(':first').each(function(index, value) {
                        var keyPrefix = 'data[' + index + ']';
                        postData[keyPrefix + '[supp_short_code]'] = $(this).closest('tr').find('.supp_short_code').text();
                        postData[keyPrefix + '[project_ref]'] = $(this).closest('tr').find('.project_ref').text();
                        postData[keyPrefix + '[om_part_no]'] = $(this).closest('tr').find('.om_part_no').text();
                        postData[keyPrefix + '[description]'] = $(this).closest('tr').find('.description').text();
                        postData[keyPrefix + '[quantity_input]'] = $(this).closest('tr').find('.quantity_input').val();
                        postData[keyPrefix + '[cost_of_items]'] = $(this).closest('tr').find('.cost_of_items').text();
                        postData[keyPrefix + '[cost_total_td]'] = $(this).closest('tr').find('.cost_total_td').text();
                    });

                $.ajax
                    ({
                    type: "POST",
                    url: "updateorder.php",
                    dataType: "json",
                    data: postData,
                    cache: false,
                    success: function()
                        {
                            alert("Order Updated");
                        }
                    });
            });

Answer 1

Well first of all, is $_POST[‘data’] an array of arrays? Seems a bit odd to me. A foreach loop iterates through each item in the array, and retrieves the key and value after the as. So is this what you meant?

if (isset($_POST['data']) && is_array($_POST['data'])) {
  foreach ($_POST['data'] as $row => $data) {
    $result = mysql_query("UPDATE orders SET $row='$data' WHERE order_id = '" . $_POST['data']['order_id'] . "';");
  }
}

Second point is that you shouldn’t create a new SQL query for each field. Try this:

if (isset($_POST['data']) && is_array($_POST['data'])) {
  $sql = "UPDATE orders SET ";
  foreach ($_POST['data'] as $row => $data) {
    $sql .= "$row = '$data'";
  }
}
$sql .= " WHERE order_id = '" . $_POST['data']['order_id'] . "'";
$result = mysql_query($sql);

And thirdly, read up on SQL injection. At the very minimum, put mysql_real_escape_string() around the $row and $data variables and the $_POST[‘data’][‘order_id’]. So:

if (isset($_POST['data']) && is_array($_POST['data'])) {
  $sql = "UPDATE orders SET ";
  foreach ($_POST['data'] as $row => $data) {
    $sql .= "mysql_real_escape_string($row) = 'mysql_real_escape_string($data)'";
  }
}
$sql .= " WHERE order_id = '" . mysql_real_escape_string($_POST['data']['order_id']) . "'";
$result = mysql_query($sql);