0

I want to update my database with the text a user has to submit.

If I press submit it doesn't work (ERROR 2):

<form method="post">
  <input type="text" name="url" id="text" placeholder=<?php echo $userRow[ 'link']; ?>>
  <p>
    <input type="submit" value="Submit" name="submit" />
  </p>
</form>

and this is the php code

if (isset($_POST['submit'])) {
    if (isset($_POST['url'])) {
        $urlpart = '.com';
        if (strpos($_POST['link'], $urlpart) !== false) {
            $link = $_POST['link'];
            $user = $_SESSION['user'];
            $query = mysql_query("UPDATE users_steam SET tradelink='$tradelink' WHERE id='$user'");
            echo '<script language="javascript">';
            echo 'alert("URL updated")';
            echo '</script>';
        }
        else {
            echo '<script language="javascript">';
            echo 'alert("URL not valid! ERROR 1")';
            echo '</script>';
        }
    }
    else {
        echo '<script language="javascript">';
        echo 'alert("URL not valid! ERROR 2")';
        echo '</script>';
    }
}
dhh
  • 4,289
  • 8
  • 42
  • 59
FriedChicken
  • 59
  • 1
  • 7
  • 1
    `$_POST['link']` you have no matching element with that name attribute. You need to check for the real errors here. and we've no way to tell if you started that session of yours. – Funk Forty Niner Jun 27 '16 at 19:27
  • [Little Bobby](http://bobby-tables.com/) says [your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php). Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! – Jay Blanchard Jun 27 '16 at 19:27
  • Please [stop using `mysql_*` functions](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php). [These extensions](http://php.net/manual/en/migration70.removed-exts-sapis.php) have been removed in PHP 7. Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [PDO](http://php.net/manual/en/pdo.prepared-statements.php) and [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) and consider using PDO, [it's really pretty easy](http://jayblanchard.net/demystifying_php_pdo.html). – Jay Blanchard Jun 27 '16 at 19:27
  • The first step in examining your code really should be to format it so that it's understandable. Making your code confusing seems to be confusing you. – David Jun 27 '16 at 19:28
  • One other piece of advice, if you find you are essentially writing something three (or more) times with each version having one slight difference, there is likely room for efficiency. In this instance, you really only need to write the javascript portion one time at the end inserting the message as a variable. Instead of writing the js after the `if`/`else`, just do `$msg = "URL not valid! ERROR 2"` and write at the bottom: `... echo 'alert("'.$msg.'")';` Anyway, take it or leave it. – Rasclatt Jun 27 '16 at 20:05
  • `echo '
    '.print_r($_POST, true).'
    ';` is going to be your best friend.     – MonkeyZeus Jun 27 '16 at 20:09

0 Answers0