Updating DB data from PHP variables

Question

I have a problem with variables in an SQL Statement. I have a form where a user can update his profile. The form redirects to action.php?action=settings

When I try without $variables, there is no problem! But the thing is, I have a lot of queries like this, but not for updating.

function change_user_data($trainer) {
    require("database.php");

    try {
        $results = $db->query("UPDATE trainer SET email='$email', status='$status', password='$password' WHERE name='$trainer'");        
    } catch (Exception $e) {
        echo "Data could not be changed!";
        exit;
    }
}

and this is my action.php

if ($action == "settings")  {
    $email = $_POST['email'];
    $status = $_POST['status'];
    $password = $_POST['password'];

    change_user_data($trainer);
}

When I echo those $variables, they get displayed so they are not empty. But this query updates my table but with no data, so everything is empty afterwards.

I'm not an expert in PHP, but from this question, I think there is a problem with concatenating the data in the query. However, this seems prone to SQL injection and would be better to use prepared statements — Andrew T.
– Andrew T., Commented Sep 26, 2014 at 7:50

Youngsik Oh · Accepted Answer · 2014-09-26 07:49:09Z

0

I think the problem is variable scope.

Variables defined outside of function cannot use in function except global variable or something.

You have two method.

First. If change_user_data function is in action.php file, add "global $email, $status, $password" like this:

function change_user_data($trainer) {

    global $email, $status, $password;

    require("database.php");

    try {
        $results = $db->query("UPDATE trainer SET email='$email', status='$status', password='$password' WHERE name='$trainer'");        
    } catch (Exception $e) {
        echo "Data could not be changed!";
        exit;
    }
}

Or second. Pass the email, status, password data to function. Then you can use it.

Please check this manual:

http://php.net/manual/en/language.variables.scope.php

answered Sep 26, 2014 at 7:49

Youngsik Oh

541 silver badge4 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Hanky Panky Over a year ago

While your diagnosis is correct, the prescription might not be. Please don't advise the use of global variables for something that's so simple it can be done with adding parameters to the function

Christopher Supertramp Over a year ago

so this worked for me but i did it like Touregsys wrote: change_user_data($trainer, $email, $password, $status); I think this is the best way for things like that or what do you think? can you tell me why i should use global

Omesh · Accepted Answer · 2014-09-26 07:50:19Z

0

you can try this:

$results = $db->query("UPDATE trainer SET email='".$email."', status='".$status."', password='".$password."' WHERE name='".$trainer."'");

answered Sep 26, 2014 at 7:50

Omesh

29.4k6 gold badges44 silver badges51 bronze badges

Comments

user2846400 · Accepted Answer · 2014-09-26 07:50:59Z

0

change_user_data($trainer, $email, $password, $status);

function change_user_data($trainer, $email, $password, $status) {
    require("database.php");

    try {
        $results = $db->query("UPDATE trainer SET email='$email', status='$status', password='$password' WHERE name='$trainer'");        
    } catch (Exception $e) {
        echo "Data could not be changed!";
        exit;
    }
}

answered Sep 26, 2014 at 7:50

user2846400

Comments

vamsisnikky · Accepted Answer · 2014-09-26 07:52:01Z

0

After You Gettings Post varibles Then Check For those variables whether those are empty or not if not empty or NULL Then Update Database with Update Query With Non empty Variables

answered Sep 26, 2014 at 7:52

vamsisnikky

111 bronze badge

Comments

lyhong · Accepted Answer · 2014-09-26 08:14:33Z

0

May be

Wrong data type of your columns. Check your table structure carefully. Example: if you set you column email as int then you cannot insert or update it's row value as text or letter
Incorrect variables inside single quote. Try to concatenate variable and query string for better practice

If those don't work

Try to make mysql syntax error and check values of those variables, then you can define the error.

Sorry for my bad english

answered Sep 26, 2014 at 8:14

lyhong

9471 gold badge13 silver badges24 bronze badges

Comments

meda · Accepted Answer · 2014-09-26 16:02:20Z

You have few problems with this function:

Scoping issue, you did not pass all values
You are vulnerable to sql injection
You dont check if the record is updated

function:

function change_user_data($db, $params) {
    try {
        $sql = "UPDATE trainer SET email= ?, status=?, password=? WHERE name=?";
        $stmt = $db->prepare($sql);  
        $stmt->execute($params);
        $success = ($stmt->rowCount() > 0) ? true : false;
    } catch (Exception $e) {
        echo "Data could not be changed!";
        $success = false;
    }
return $success;
}

Usage

require("database.php");

$params = array($trainer, $email, $password, $status);
$user_data_updated = change_user_data($db, $params);

if($user_data_updated){
  echo 'user data updated';
}else{
  echo 'user data did not update';
}

Collectives™ on Stack Overflow

Updating DB data from PHP variables

6 Answers 6

2 Comments

Comments

Comments

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

6 Answers 6

2 Comments

Comments

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related