PHP Value didn't pass in update query

Question

I was looking why my mysql doesn’t work, but didn’t find anything helping me in this case.

My issue is that I want to update my database by insering a date in it with a specific id taken in $_GET. Here was looking at :

$date = date('Y-m-d', time());

session_start();
header( 'content-type: text/html; charset=utf-8' );
require_once("cnx_db_inventory.php");
$idComputer=$_GET['idComputer'];
$query="select computer.computer_id,
    computer.computer_name
    from computer
    where computer.computer_id='$idComputer'";
$data = get_array($query);
foreach($data as $value) {
    $computername=$value['computer_name'];
}

//Update the database
if(isset($_GET['validate'])){
    $idComputer;
    $query="UPDATE computer
    SET deleted_date='$date'
    WHERE computer.computer_id=$idComputer";
    mysql_query($query);
    echo $query;
}

My echo of my query looks like this went validate :

UPDATE computer SET deleted_date='2017-04-07' WHERE computer.computer_id=

And if I put some quotes (' ') to $idComputer, the echo gave me this :

UPDATE computer SET deleted_date='2017-04-07' WHERE computer.computer_id=”

But it gave me the id if I echo outside the isset() (see here). Why then, when I click on validate, the computer_id didn’t pass through?

My form look like this :

<form id="general" name="general" action="delete.php" method="get">
    Are you sure you want to delete this?<br />
    <strong><font size="2" color ="black">Computer name </font></strong>
    <input type="text" id="computername" name="computername" value="<?php echo $computername;?>"/><br />
    <input type="submit" name="validate" value="Validate" class="button">
    <input type="submit" name="cancel" class="button" value="Cancel" onClick="general.action='researchInventory.php'; return true;"/>
</form>

I try to put the $IdComputer in the isset, but doesn’t change anything. I’ve got a similar issue like that before and that was helping me fixed it, but not in this case. I try to pass the mysql_query outside the if(){}. I try to call computer.deleted_date in the SELECT, but give nothing has well.

I try to put an hidden input with the value of computer_id, try the $_post method (looking with this one), but nothing change when I validate! The computer_id doesn't pass anyway.

class DBConnection{
private static $_singleton;
private $_connection;
private function __construct(){
    $ip =$_SERVER['REMOTE_ADDR'];
    $this->_connection = @mysqli_connect(DB_HOST, DB_USER, DB_PASS,DB_NAME) or die("Could not connect to database");
mysqli_set_charset($this->_connection,"utf8");
}
public static function getInstance(){
    $ip =$_SERVER['REMOTE_ADDR']; 
    if (is_null (self::$_singleton)) {
        self::$_singleton = new DBConnection();
            mysqli_set_charset('utf8');//Line 20;
    }
        return self::$_singleton;
    }
    public  function getHandle(){
        return $this->_connection;
    }
}

Answer 1

Working example : added POST method just because I don't like GET that much :) and a hidden field with ID

<?php

error_reporting(E_ALL);
ini_set('display_errors', 1);

include"config.inc.php"; // only DB parameters in here

$mysqli = mysqli_connect("$host", "$user", "$mdp", "$db");

if (mysqli_connect_errno()) { echo "Error connecting : " . mysqli_connect_error($mysqli); }

$id = $_GET['id']; /* assuming that your reach this page with an URL parameter ?id=3 ou any number */
echo"[ 1st check on ID -> $id ]";

// TODO -> clean var ID and check if set/numeric

if(isset($id)) {

/* prepare select */

$query = " SELECT computer_id, computer_name FROM computer WHERE computer_id=? ";
$stmt = $mysqli->prepare($query);

$stmt->bind_param("s", $id); /* if integer ID -> 's' becomes 'i' */

$results = $stmt->execute();
$stmt->bind_result($computer_id, $computer_name);
$stmt->store_result();

if ($stmt->num_rows > 0) {

while($stmt->fetch()){
echo"[ $computer_id -> $computer_name ]<br />";
}
}
else { echo"[ no data ]"; }

//$stmt->free_result();

} else { echo"[ no ID defined ! ]"; }

// Update the database
if(isset($_POST['validate'])){

$date = date('Y-m-d', time());
$idComp = $_POST['computerID'];

/* prepare update */

$query1 = " UPDATE computer SET deleted_date=? WHERE computer_id=? ";
$stmt1 = $mysqli->prepare($query1);

$stmt1->bind_param("ss", $date, $idComp); /* if integer ID -> 'ss' becomes 'si' */

if (!$stmt1->execute()) { echo"false -> update failed"; echo $stmt1->error; } else { echo"true -> update ok"; }

$stmt1->free_result();
}

?>

<form id="general" name="general" action="delete.php" method="post">
<input type="hidden" id="computerID" name="computerID" value="<?php echo"$computer_id"; ?>" />
Are you sure you want to delete this ?<br />
<strong>Computer name</strong>
<input type="text" id="computername" name="computername" value="<?php echo"$computer_name"; ?>" /><br />
<input type="submit" name="validate" value="Validate" class="button" />
</form>

EDIT : As mysql_* was deprecated in PHP 5.5 (please refer to PHP doc) you should prefer PPS : Prepared Parameterized Statements. This will help Preventing SQL injection

Answer 2

$idComputer=$_GET['idComputer'];
$query="select computer.computer_id,
    computer.computer_name
    from computer
    where computer.computer_id='$idComputer'";

.
.
.

$query="UPDATE computer
    SET deleted_date='$date'
    WHERE computer.computer_id=$idComputer";

Is computer.computer_id a string-type column? If so, the value in your update statement has to be in single quotes.

Also, this is very bad practice. Someone could visit http://yoursite.com/yourscript.php?idComputer=Boston';DROP TABLE computer;-- and really mess you up. You should use prepared statements, or at least use the mysql_escape_string() function.

The same kind of idea applies to your HTML output as well.

<input type="text" id="computername" name="computername" value="<?php echo $computername;?>"/><br />

This should be something like

<input type="text" id="computername" name="computername" value="<?php echo htmlspecialchars($computername); ?>"/><br />