0

I'm not sure if I'm asking correctly in the title but here's the info:

I have a website that starts with a client entering their ID number. This then populates a page where they can select a product to have sent to them. This page has their name, mailing info, etc, and a submit button which sends which option they chose to a "master" database.

Is there a way to update a specific database based on what their ID number starts with? For example, if their ID number starts with an AB, I want the "master" database to be updated. If it starts with XY, I want the "masterXY" database to be updated.

I say this everytime I post a question, just to let everyone know I have no experience whatsoever with PHP, MySQL, etc. I'm taking over for a coworker that never really cared what his code looked like as long as it worked - so I apologize if this code looks horrible as I don't know what a good one looks like as of yet.

I think this is the code you'll need to see in order to see what database is currently being updated (but again, I'm not really sure).

if ((isset($_POST["MM_update"])) && ($_POST["MM_update"] == "update")) {

    $updateSQL = sprintf("UPDATE master SET name=%s, company=%s, address=%s, address2=%s, city=%s, st=%s, zip=%s, phone=%s, email=%s, request=%s, product1=%s, product2=%s, remoteip=%s, lastchange=%s, source=%s, via=%s WHERE id=%s",

                         GetSQLValueString(($_POST['name']), "text"),
                         GetSQLValueString(($_POST['company']), "text"),
                         GetSQLValueString(($_POST['address']), "text"),
                         GetSQLValueString(($_POST['address2']), "text"),
                         GetSQLValueString(($_POST['city']), "text"),
                         GetSQLValueString(strtoupper($_POST['st']), "text"),
                         GetSQLValueString(strtoupper($_POST['zip']), "text"),
                         GetSQLValueString(strtoupper($_POST['phone']), "text"),
                         GetSQLValueString(strtoupper($_POST['email']), "text"),
                         GetSQLValueString($_POST['request'], "text"),
                         GetSQLValueString(isset($_POST['product1']) ? "true" : "", "defined","1","0", "int"),
                         GetSQLValueString(isset($_POST['product2']) ? "true" : "", "defined","1","0", "int"),
                         GetSQLValueString($REMOTE_ADDR, "text"),
                         GetSQLValueString($date, "date"),
                         GetSQLValueString($_SERVER['HTTP_USER_AGENT'], "text"),
                         GetSQLValueString($via, "text"),
                         GetSQLValueString($_POST['id'], "int"));


    mysql_select_db($database_numark, $mySQL);
    $Result1 = mysql_query($updateSQL, $mySQL) or die(mysql_error());
    $LOG2 = mysql_query("INSERT INTO log (date,site,ip,id_number,info) values ('$date','$SITE','$REMOTE_ADDR','$idnumber','Update and Request Submitted')");

    $insertGoTo = "/confirm.php";
    if (isset($_SERVER['QUERY_STRING'])) {
        $insertGoTo .= (strpos($insertGoTo, '?')) ? "&" : "?";
        $insertGoTo .= $_SERVER['QUERY_STRING'];
    }
    header(sprintf("Location: %s", $insertGoTo)); 
}

if(isset($_POST['idnumber'])){
    $idnumber = $_POST['idnumber'];
    $LOG1 = mysql_query("INSERT INTO log (date,site,ip,id_number,info) values ('$date','$SITE','$REMOTE_ADDR','$idnumber', 'ID Entered')");

   mysql_select_db($database_mySQL , $mySQL );
   $query_master = "SELECT * FROM master WHERE mixedme = '$idnumber'";
   $master = mysql_query($query_master, $mySQL ) or die(mysql_error());
   $row_master = mysql_fetch_assoc($master);
   $totalRows_master = mysql_num_rows($master);
}
Marina
  • 161
  • 8
  • this will not sove your probem but read please https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php – nbk Apr 01 '20 at 18:26
  • It looks like by "*database* master" you are referring to "*table* master". The SQL text (the contents of `$updateSQL`) would need to start either `UPDATE master SET ...` or `UPDATE masterXY SET ...`. One option would be to precede that with a condition check `if ( somecondition ) { $table_name = "master"; } else { $table_name = "masterXY"; }` and then reference $table_name variable, `$updateSQL = sprintf("UPDATE $table_name SET ...` that's just one possible approach. – spencer7593 Apr 01 '20 at 18:29
  • Does this answer your question? [Why shouldn't I use mysql\_\* functions in PHP?](https://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php) – Dharman Apr 01 '20 at 20:45

0 Answers0