You're right. It's not actually sent. But the variable will exist on the server whether or not there's currently any data in it. In other words, it wouldn't have to be sent. I'm not entirely sure that's the problem though, but I think it very likely. This is what I see happening with the logic:
STEP 1 Pull all records from the table WHERE...
STEP 2 Overwrite that data with the current value of $_POST (null if nothing has been sent).
STEP 3 User (or you in this case) issues a call to UPDATE test@test.mail. Oops! Step 2 already took place, now test@test.mail is NULL too.
But again, I didn't fully examine the update for anything else that could be causing any other problems. Given what you mentioned however, this scenario could very well be what's taking place here. Worth a shot anyway.
-- Sat Apr 02, 2011 6:58 am --
First, if my last post seemed as if I wasn't giving this my full attention, that's simply because I wasn't. I have to admit that. I'm working on a few things at once here, so I apologize, and hope you didn't take it personally. I've got two editors open at all times, and a third whenever it's needed. So, like I said, it wasn't anything personal. With that said, here we go...
I took a shot at reworking this. And, after some playing around with it, I managed to get it all to function from the same file without the two queries interfering with one another. Stay with me here, this
IS NOT a solution. Instead, it's a better place to begin debugging. Before I get to it though...
FunctionCreep wrote:- Code: Select all
while($query) {
$query2 = mysql_query("UPDATE ....etc")
}
to prevent any $_POST from being sent prematurely by the update form. Basically i'm thinking that the problem lies within the search and that when I press search, all $_POST are submitted, and since the update form is empty at that time,it sents the empty values causing the entry in the db to be "erased" until I resubmit the new data.
I don't think I understand what you're going for there. But, if it's cleaner than what I'm about to post, or you, or somebody else, knows of a better method, then by all means use it. Also, I'm thinking the majority of the issue was where the search and UPDATE overlap within the file. So, you may very well be on the right track by assuming the search is responsible.
I guess I promised a rewrite here, so without further ado. My "fix" here, is really just me trying to track down any problems I could, while ensuring the given queries wouldn't be executed unless they actually needed to be. It really serves no other purpose than to be a rewrite fit for debugging. But, I commented the shit out of it, so it's easier for you to see what I'm doing.
- Code: Select all
<?php
// ------------------------------------------------------------------------
//
// name: sanitize($str)
//
// desc: Returns an "SQL-safe" version of the input $str.
//
// note: This isn't full or proper sanitization. Just something to get
// by until then. You should definitely flesh it out, before you
// actually use it.
//
// ------------------------------------------------------------------------
function sanitize($str)
{
return mysql_real_escape_string($str);
}
///////////////////////////////////////////////////////////////////////////
// === SEARCH SECTION =====================================================
///////////////////////////////////////////////////////////////////////////
// ------------------------------------------------------------------------
//
// Get search parameters and results. If there are any that is.
//
// ------------------------------------------------------------------------
if( isset($_POST['select_term']) && ($_POST['select_term'] != null) )
{
$query_string = "SELECT * FROM members WHERE EmailName = '" . sanitize($_POST['select_term']) . "'";
$result = mysql_query($query_string);
if( !$result )
{
die( mysql_error() );
}
$row = mysql_fetch_array($result);
}
///////////////////////////////////////////////////////////////////////////
// === UPDATE SECTION =====================================================
///////////////////////////////////////////////////////////////////////////
// ------------------------------------------------------------------------
//
// Handle user updates.
//
// ------------------------------------------------------------------------
$postData = array();
// rip data only from any set post variables
foreach($_POST as $key => $value)
{
$postData[$key] = sanitize($value);
}
// ensure that there's something that needs updating
if( $postData && !isset($_POST['select_term']) )
{
// first remove $postData['Submit'] ... it's no longer needed
unset( $postData['Submit'] );
// perform each update independently
foreach($postData as $key => $value)
{
$query_string = "UPDATE members SET $key='" . $value . "' WHERE emailname='" . $postData['emailname'] . "'";
$result = mysql_query($query_string);
// die on failure with some type of error
if( !$result )
{
die( "Received: " . mysql_error() . " while issuing $query_string" );
}
// just echoing for demo purposes here
echo $result . "<br />";
}
}
?>
In the above, there's a matter of case sensitivity between the name used for your forms inputs, and the ones you used when making queries to the database. You can set configuration options for MySQL that will ignore case sensitivity within tables and columns names, but from a security standpoint, it's actually a smart move to have them be different here. So this can be remedied in a few ways. I like to assign the names to a hash table, and then index into it using the names from the form inputs. Like this:
- Code: Select all
// example using your database names.
$post_aliases = array( 'title' => 'Title', 'firstname' => 'FirstName', ... etc );
Now, to get that to function, you would change this line:
- Code: Select all
$query_string = "UPDATE members SET $key='" . $value . "' WHERE emailname='" . $postData['emailname'] . "'";
To this:
- Code: Select all
$query_string = "UPDATE members SET " . $post_aliases[$key] . "='" . $value . "' WHERE EmailName='" . $postData['emailname'] "'";
You'll have to ignore the word wrapping going on in that code. I ran a little long with the MySQL queries so that they would all fit on a single line. The code tags here don't seem to like it much. I feel like I'm forgetting to mention something here, but I'm drawing a blank so... Hopefully I caught the bulk of it for you with that.
