Insert & update sql data using php

Question

i've a registration form & im trying to insert data if 'ID' doesn't exists. its working fine. now im trying to update data if 'ID' already exists. it's not working at all & i couldn't find the error. here is the condition i set if ID exists or not:

function staff_detail_exist($ic) {    
    $result = null;
    $sql = "SELECT * FROM apply WHERE staffid = '$ic'";
    $data = mysql_query($sql);

    if (mysql_num_rows($data) == 0) {    
        $result = "available";
    } else {    
        $result = "exist";
    }

    return $result;
}

and here is my insert & update function:

 if (staff_detail_exist($ic) == "available") {

    insert_staff_detail($ic, $name, $contact, $mail, $address, $paytype, $applicant);
    echo "Workshop application successful! You will be notified shortly via E-mail after confirmation! Thank You!";
} 
else if (staff_detail_exist($ic) == "exist") {

    update_staff_detail($ic, $name, $contact, $mail, $address, $paytype);
    echo  "Staff Details Updated!" ;
}

function insert_staff_detail($ic, $name, $contact, $mail, $address, $paytype, $applicant) {

    $sql = "INSERT INTO apply (staffid, staffname, staffno, staffemail, staffaddress, paytype, applicant) VALUES ('$ic', '$name', '$contact', '$mail', '$address','$paytype', '$applicant')";
    mysql_query($sql);
}

function update_staff_detail($ic, $name, $contact, $mail, $address, $paytype){
    $sql = "UPDATE apply 
            SET staffname='$_POST[name]',
            staffno='$_POST[contact]',
            staffmail='$_POST[mail]',
            address='$_POST[address]',
            paytype='$_POST[paytype]'
            WHERE staffid='$_POST[ic]'";
    mysql_query($sql);
}

any suggestion please? thanks!

By not sanitizing data taken from the user before it is inserted into the database. — patricksweeney
– patricksweeney, Commented Dec 10, 2012 at 2:55
Btw, is there a reason why update_staff_detail() is ignoring it's parameters and using the $_POST variables? Could that be your problem? — Mawg
– Mawg, Commented Dec 10, 2012 at 2:58
Any time to take into from the user, you need to make sure you sanitize the information. They may pass in information that drop all your tables in the DB, for example. Look at bobby-tables.com for a starting example. — patricksweeney
– patricksweeney, Commented Dec 10, 2012 at 3:01

alditis · Accepted Answer · 2012-12-10 03:10:45Z

1

Observation: You must indicate when you receive POST variables. The update_staff_detail method should receive POST variables in the same way you get the insert_staff_detail method.

Change: Definition of update_staff_detail

To:

function update_staff_detail($ic, $name, $contact, $mail, $address, $paytype){
    $sql = "UPDATE apply 
            SET staffname='$name',
            staffno='$contact',
            staffmail='$mail',
            address='$address',
            paytype='$paytype'
            WHERE staffid='$ic' LIMIT 1";
    mysql_query($sql);
}

Regards.

edited Dec 10, 2012 at 3:10

answered Dec 10, 2012 at 3:02

alditis

4,8473 gold badges53 silver badges79 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Kermit Over a year ago

Perhaps a LIMIT 1 would be well suited for this.

alditis Over a year ago

Would help you enter the complete code you receive insert_staff_detail method from POST variables.

Atik Over a year ago

i used this to get values from from: ` $ic = mysql_real_escape_string($_POST['ic']); $name = mysql_real_escape_string($_POST['name']); $contact = mysql_real_escape_string($_POST['contact']); $mail = mysql_real_escape_string($_POST['mail']); $address = mysql_real_escape_string($_POST['address']); $paytype = mysql_real_escape_string($_POST['paytype']); $applicant = mysql_real_escape_string($_POST['applicant']);`

Collectives™ on Stack Overflow

Insert & update sql data using php

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related