-1

I want to create an update and a delete button at the end of every row and i am succeeded in it

<?php   

      while($row = mysqli_fetch_array($result))
      {
          ?>
        <tr>
            <?php echo "<form action=update.php method=post>"; ?>
            <td><?php echo $row['id']; ?></td>
            <td><?php echo "<input type=text name=fName value=" . $row['fName']; ?> </td>
            <td><?php echo "<input type=text name=lName value=" . $row['lName']; ?> </td>
            <td><?php echo "<input type=text name=username value=" . $row['username']; ?> </td>
            <td><?php echo "<input type=text name=mobile value=" . $row['mobile']; ?> </td>
            <td><?php echo $row['timeStamp']; ?> </td>
            <td><?php echo "<input type=submit value=Update>"; ?> </td>
            <td><?php echo "<input type=submit value=Delete>"; ?> </td>
            <?php echo "</form>";?>
        </tr>

<?php  }

But I cannot get the functionality of these buttons. Can anyone tell me where is the problem

if(isset($POST_['Update']))
    {
        $sql = "UPDATE users SET fName='$_POST[fName]',lName='$_POST[lName]',username='$_POST[username]',mobile='$_POST[mobile]' WHERE id='$_POST[id]'";

        if(mysqli_query($conn, $sql))
        {
            echo "Database Updated";
            header("refresh:1; url=home.php");
        }
        else
        {
            echo "Not Updated";
        }

    }

    if(isset($POST_['Delete']))
    {
        $sql = "DELETE FROM users WHERE id='$_POST[id]'";

        if(mysqli_query($conn, $sql))
        {
            header("refresh:1; url=home.php");
        }
        else
        {
            echo "Not Deleted";
        }
    }
Qirel
  • 25,449
  • 7
  • 45
  • 62
Umair Butt
  • 7
  • 1
  • 1
    It's not `$POST_['Update']`, it's `$_POST['Update']`. – Qirel Jul 31 '17 at 10:30
  • 1
    You're already using an API that supports **prepared statements** with bounded variable input, you should utilize parameterized queries with placeholders (prepared statements) to protect your database against [SQL-injection](http://stackoverflow.com/q/60174/)! Get started with [`mysqli::prepare()`](http://php.net/mysqli.prepare) and [`mysqli_stmt::bind_param()`](http://php.net/mysqli-stmt.bind-param). – Qirel Jul 31 '17 at 10:30
  • You should have quotes round all of the HTML attributes. – Nigel Ren Jul 31 '17 at 10:33

2 Answers2

2

I think because you didn't set a name for update and delete in this section:

    <td><?php echo "<input type=submit value=Update>"; ?> </td>
    <td><?php echo "<input type=submit value=Delete>"; ?> </td>

try make it like this : 

        <td><?php echo "<input type=submit name=Update value=Update>"; ?> </td>
        <td><?php echo "<input type=submit name=Delete value=Delete>"; ?> </td>

+ It's not $POST_['Update'], it's $_POST['Update']

Abdul Rahman
  • 70
  • 5
-1

Please set the input name on both (you should also use single quotes) Instead of 

<input type=submit value=Update>

use

<input type='submit' name='Update' value='Update'>
<input type='submit' name='Delete' value='Delete'>

And in PHP

 $_POST['Update']
 $_POST['Delete']
Farsay
  • 312
  • 1
  • 9