PHP update not receiving the correct id

Question

I'm trying to update my table when I've finished editing a certain post. I'm trying to update it with the id that is pasted through.

For some reason my query isn't getting the id to update. Here is what I currently have.

Displaying the data from the database using the id that is passed through:

if (isset($_GET['id']) && is_numeric($_GET['id'])){

             $id = $_GET['id'];

             $show = mysql_query("SELECT * FROM notes WHERE '$id' = id");
             while($edit_row = mysql_fetch_assoc($show)){

                echo '
                    <tr>
                        <td align="center">Title</td>
                        <td><input type="text" name="title" value="'.$edit_row['title'].'" class="title"></td>
                    </tr>
                    <tr>
                        <td align="center">Note</td>
                        <td><textarea cols="35" rows="6" name="notes" class="notes">'.$edit_row['note'].'</textarea></td>
                    </tr>
                    <tr>
                        <td colspan="2" align="center"><input type="submit" name="submit" value="Update" class="new"></td>
                    </tr>
                ';
             }
        }

Here is my query update:

if(isset($_POST['submit'])){

    $title = trim(mysql_real_escape_string($_POST['title']));
    $notes = trim(mysql_real_escape_string($_POST['notes']));

    $update = mysql_query("UPDATE notes SET title = '$title' WHERE id = '$id'") or die(mysql_error());

    header("Location:notes.php");
}

Is there anything wrong? Is the update query not getting the id somehow?

_"I'm trying to update it with the id that is pasted through. "_ - and where are you passing the id ...? — CBroe, Jun 20 '13 at 13:03
sql injection! see http://stackoverflow.com/questions/60174/how-to-prevent-sql-injection-in-php — Carlos Campderrós, Jun 20 '13 at 13:06

score 2 · Accepted Answer · answered Jun 20 '13 at 13:05

2

From where should it get the id? You need in the HTML-code above somewhere the following:

<input type='hidden' name='id' value='.$id.' />

And in the receiving code below:

$id = trim(mysql_real_escape_string($_POST['id']));

answered Jun 20 '13 at 13:05

Paflow

2,030
3
30
50

score 1 · Answer 2 · answered Jun 20 '13 at 13:03

1

You are not sending the $_GET['id'] with your form. Add an hidden input with the id.

answered Jun 20 '13 at 13:03

Garytje

874
5
11

score -1 · Answer 3 · answered Jun 20 '13 at 13:03

-1

You try to get the id number with $_GET[] but you do not send anything via $_GET[]

answered Jun 20 '13 at 13:03

zkanoca

9,664
9
50
94

PHP update not receiving the correct id

3 Answers3