php - MYSQL Update Query not work complete

Question

I have a little Problem with my Update query to chnage the Profile Infos

Problem now:

My Update Query is not working completly, the E-Mail query work but the status query is not working.

PHP CODE

if(!empty($_POST)) {
  $query = "UPDATE users SET";
  if(!empty($_POST['email']) && filter_var($_POST['email'],   FILTER_VALIDATE_EMAIL) && $_POST['email'] != $_SESSION['u']['email']) {
    $s_mail = $_POST['email'];
    $row = mysql_num_rows(mysql_query("SELECT email FROM users WHERE email='$s_mail'"));
    if($row != 0) {
      header("Location: ".$l['settings']."?msg=2");
      die("REDIRECT");
    }
    $query .= " `email`='".$_POST['email']."'";
    $_SESSION['u']['email'] = $_POST['email'];
  } else if(!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) {
    header("Location: ".$l['settings']."?msg=3");
    die("REDIRECT");
  }
  //PROBLEM starts here
  if(!empty($_POST['status'])) {
    $query .= ",`status`='".$_POST['status']."'";
    $_SESSION['u']['status'] = $_POST['status'];
  }
  //AND ends here
  $query .= " WHERE id='".$_SESSION['u']['id']."'";
  mysql_query($query);
  header("Location: ".$l['settings']."?msg=1");
  die("REDIRECT");
}

HTML FORM

<input maxlength="200" type="text" class="form-control" placeholder="Status" name="status" value="<?php //ECHO STATUS ?>" />

Maybe someone can help me.

If you plan to let untrusted people have access to it (like, say, by putting it on the internet), take a look at the always relevant question on [SQL-injection prevention](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php). It might save you a lot of trouble later on. — tarleb, Nov 28 '15 at 21:56

Standej · Accepted Answer · 2015-11-28T11:25:55.687

0

On your $query you have

$query .= ",`status`='".$_POST['status']."'";

remove comma make it like this

$query .= " `status`='".$_POST['status']."'";

edited Nov 28 '15 at 11:25

answered Nov 28 '15 at 10:56

Standej

749
1
4
11

@DanielO. Only status not working? can you print to me value of $_POST['status']. Do you check for symbols that can make your query string not valid like ' this one? – Standej Nov 28 '15 at 11:08
Find the ERROR the E-Mail query would not be Insert every time sot the Query was `UPDATE users SET,status='TEST TEST' WHERE id='1'` – Daniel O. Nov 28 '15 at 11:15
@DanielO. because you cave comma , <- this symbol in your query in front of 'status'. – Standej Nov 28 '15 at 11:18

score 0 · Answer 2 · answered Nov 28 '15 at 11:14

You need to set a flag for email condition as

$flag = FALSE;// set a flag
if (!empty($_POST)) {
    if (!empty($_POST['email']) && filter_var($_POST['email'], FILTER_VALIDATE_EMAIL) && $_POST['email'] != $_SESSION['u']['email']) {
        $s_mail = $_POST['email'];
        $row = mysql_num_rows(mysql_query("SELECT email FROM users WHERE email='$s_mail'"));
        if ($row != 0) {
            header("Location: " . $l['settings'] . "?msg=2");
            die("REDIRECT");
        }
        $flag = TRUE;// set to true if success

        $_SESSION['u']['email'] = $_POST['email'];
    } else if (!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) {
        header("Location: " . $l['settings'] . "?msg=3");
        die("REDIRECT");
    }

    //PROBLEM starts here
    if (!empty($_POST['status'])) {
        $query = "UPDATE users SET";
        $query .= " `status`='" . $_POST['status'] . "'";
        if ($flag) {// if true then apply email condition
            $query .= ",`email`='" . $_POST['email'] . "'";
        }
        $query .= " WHERE id='" . $_SESSION['u']['id'] . "'";
        $_SESSION['u']['status'] = $_POST['status'];
    }
    //AND ends here

    mysql_query($query);
    header("Location: " . $l['settings'] . "?msg=1");
    die("REDIRECT");
}

Note:- mysql is deprecated instead use mysqli OR pdo

php - MYSQL Update Query not work complete

2 Answers2