Simple sample query working update but skips the first condition

Question

I have a php code that updates the value in 2 tables and I used left join. It works but it keeps on skipping the first condition and always enters the second condition. I have no idea on mysql injection so please advice if my code is prone to mysql injection.

elseif ($_POST['check'])
{
    if ($row[typeofdog] = 'Labrador') 
    {
            $id = $_POST['data'];   
            $count = count($id);

        for($i=0;$i<$count;$i++)
            {

            $sql = "UPDATE animals LEFT JOIN treats ON animals.style = treats.style SET animals.bone = bone - treats.total, treats.status = 'Approved' WHERE treats.id='$id[$i]'"; 
            $result = mysql_query($sql);

            }

        if($result){header("location:login_success.php");}

    }
    else
    {
        $id = $_POST['data'];   
        $count = count($id);

        for($i=0;$i<$count;$i++)
            {

            $sql = "UPDATE animals LEFT JOIN treats ON animals.style = treats.style SET animals.chunks = chunks - treats.total, treats.status = 'Approved' WHERE treats.id='$id[$i]'"; 
            $result = mysql_query($sql);

            }

        if($result){header("location:login_success.php");}

    }
}

You're using = instead of == ( logical error not a syntax one) — xd6_, Jun 05 '14 at 23:26
Thanks for th reply. I did this `if ($row[typeofdog] == 'Labrador') ` and it still skips the first condition. — Roi patrick Florentino, Jun 05 '14 at 23:31
I don't know if this will solve the problem, but `$row[typeofdog]` is incorrect. PHP is smart enough to figure out what you mean, but the correct syntax is `$row['typeofdog']`. — Mark Miller, Jun 05 '14 at 23:47
@relentless Sir can you point out what is the syntax error in the code? — Roi patrick Florentino, Jun 06 '14 at 22:11

score 2 · Answer 1 · edited May 23 '17 at 12:06

2

First, = is for assignment. == is for comparison.

Second, using the index typeofdog without quotes is incorrect. PHP explains why here.

Try this:

if ($row['typeofdog'] == 'Labrador')

If this doesn't work, then $row['typeofdog'] does not equal 'Labrador'. In that case, try echoing $row['typeofdog'] just before the conditional so you can see what is being compared.

Also, yes, you are at risk for sql injection. First step to fixing this: don't use mysql. Instead use mysqli or pdo and utilize prepared statements.

edited May 23 '17 at 12:06

Community

1
1

answered Jun 05 '14 at 23:58

Mark Miller

7,442
2
16
22

Tried one given by you sir but its not working either. – Roi patrick Florentino Jun 06 '14 at 22:02
@Patrick Did you `echo $row['typeofdog'];` before the `if`. Are you sure it equals 'Labrador'? – Mark Miller Jun 06 '14 at 22:30

Simple sample query working update but skips the first condition

1 Answers1