Simple update/edit of data not working with PHP/MySql

Question

I am trying to do a simple edit/update of my data in the database. But somehow it will not work.

So I am able to read out the saved data into the form. I also don't have any errors

I have stared at my code and googled for hours but I don't see where I might have made a mistake with my code.

The printed echo gives the following output which seems to be right:

HTML code:

<form id="formAddCategory" class="FrmCat" action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
    <div class="form-group">
        <!-- hidden id from tbl -->
        <input type="hidden" name="hiddenId" value="<?php echo $hiddenID ?>" />
        <label for="recipient-name" class="control-label">Category Name:</label>
        <input type="text" class="form-control" id="recipient-name1" name="category" required="" value="<?php echo $category ?>" />
     </div>
     <button type="submit" id="btnEditCat" class="btn btn-danger" name="editCategory">Save Category</button>
</form>

Part of my php code to edit/update:

<?php
//edit/update data to db
if(isset($_POST['editCategory'])){
  $categoryUpdate = mysqli_real_escape_string($con, $_POST['category']);
  $categoryID = mysqli_real_escape_string($con, $_POST['hiddenId']);
  $qry = "UPDATE tbl_Category SET category = $categoryUpdate WHERE category_id = $categoryID"; 
  $result = mysqli_query($con, $qry);
  echo $qry;

  if($result){
    header("Location: category.php"); 
  }
}

?>

score 2 · Answer 1 · answered Aug 03 '16 at 05:23

2

You need single quote ' to wrap your parameter:

$qry = "UPDATE tbl_Category SET category = '$categoryUpdate' WHERE category_id = '$categoryID'";

answered Aug 03 '16 at 05:23

Blank

12,308
1
14
32

omg such a stupid mistake and i have been staring for hours at my code. thanks – GY22 Aug 03 '16 at 05:25

score 1 · Accepted Answer · edited May 23 '17 at 10:28

You should use single quotes (') for values

 $qry = "UPDATE tbl_Category SET category = '$categoryUpdate' WHERE category_id = '$categoryID'";

Also you can use like this to avoid SQL injection (See here)

$stmt = $dbConnection->prepare('SELECT * FROM employees WHERE name = ?');
$stmt->bind_param('s', $name);

$stmt->execute();

$result = $stmt->get_result();
while ($row = $result->fetch_assoc()) {
    // do something with $row
}

Simple update/edit of data not working with PHP/MySql

2 Answers2