can't update mysql database using php

Question

I am trying to update a record on my customer mysql table. However I get the following errors:

Notice: Undefined index: username in E:\EasyPHP-12.1\www\Register1.php on line 313

Notice: Undefined variable: db_password in E:\EasyPHP-12.1\www\Register1.php on line 315 error updating record

I can't see anything wrong with my code. And have been looking at it for a few hours with no luck.

<div class="footer">
  <img src="images/gardening5.jpg" alt="Image">
  <div>
    <h1>Tips of the Week</h1>
    <form method= "get">
      <form method="get">
      <p>Username:
        <input name="username" type="text">
        </p>
      </form>
      <p>
      <form method="get">
        <p>Password:
          <input name="password" type="password">
        </p>
        <p>First Name:
          <input name="first name" type="first name">
        </p>
        <p>Last Name:
           <input name="last name" type="last name">
        </p>
        <p>1st Line of Address:
          <input name="1st line of address" type="1st line of address">
        </p>
        <p>2nd Line of Address:
          <input name="2nd line of address" type"2nd line of address">
        </p>
        <p>Town:
           <input name="town" type"town">
        </p>
        <p>PostCode:
          <input name="postcode" type="postcode">
        </p>
        <p>Phone Number
          <input name="phone_number" type="phone_number">
        </p>
        <p>
          <input name="submit3" type="submit" value="update customer record">
        </p>
       </form>
     </form>
<?php
  $host="localhost"; // Host name
  $tbl_name="customer"; // Table name
  $db_user="root";
  $db_pass="";

  $connect = mysql_connect("$host", "$db_user", "$db_pass");
  $db_name="the_shop"; // Database name
  mysql_select_db("$db_name");

  if(isset($_GET['submit3'])){

    $db_username = $_GET['username'];

    $sql3 = "UPDATE `customer` SET `Password`='.$db_password.' WHERE `Username`='.$db_username.";
    $result3 = mysql_query($sql3);

    mysql_query($sql3) or die('error updating record');
    echo $sql3;
  }
?>

You have several forms embedded into one parent form. You only need one. — Robbert
– Robbert, Commented May 10, 2013 at 22:21
And, in addition, your code is vulnerable to SQL injections. Moreover, there is no need to use statements like "$host" rather than simple $host — Timur
– Timur, Commented May 10, 2013 at 22:31
Please don't pass $_GET or $_POST variables into your sql strings. You will be vulnerable to sql injection. — andy magoon
– andy magoon, Commented May 10, 2013 at 23:18

Paul Roub · Accepted Answer · 2013-05-10 22:25:29Z

2

The username field in your HTML is in a different form than the submit button, so it's not being sent along with the rest of the fields.
You have no $db_password variable; you do have a $db_pass variable. Is that what you meant?
For requests that modify data, you should really use POST, not GET requests.

As noted in the comments:

You should use $db_password = $_GET['password'], and correct the quotes as in peterm and Mehdi's answers.

edited May 10, 2013 at 22:25

answered May 10, 2013 at 22:16

Paul Roub

36.5k27 gold badges88 silver badges95 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Timur Over a year ago

One comment. @Chris should use $db_password = $_GET['password']. $db_pass is a database credential, not users password

Timur Over a year ago

Also, there is possible concatenation in query with inappropriate use of different qoutes type - see @peterm answer

CodeZombie Over a year ago

4. Opening a SQL connection before even checking if $_GET['submit3'] is true. 5. Using deprecated mysql extension is discouraged. 6. No error checking at all. 7. Vulnerable to SQL injections.

peterm · Accepted Answer · 2013-05-10 22:21:35Z

1

There are several problems with your code:

You're not getting username parameter with GET method. html markup should be corrected to properly define one form instead of having several.

You don't have $db_password variable defined. It's probably meant to be

$db_password = $_GET['password'];

There is invalid concatenation in $sql3.Therefore change

$sql3 = "UPDATE `customer` SET `Password`='.$db_password.' WHERE `Username`='.$db_username.";

to

$sql3 = "UPDATE `customer` SET `Password`='$db_password' WHERE `Username`='$db_username'";

edited May 10, 2013 at 22:21

answered May 10, 2013 at 22:16

peterm

93k16 gold badges157 silver badges162 bronze badges

4 Comments

Timur Over a year ago

$db_password is not defined here

peterm Over a year ago

@Timur That's exactly what I said. html markup should be corrected to properly define form.

Timur Over a year ago

There was no $db_password = $_GET['password']; line in your answer when commented. Your answer is good now, yes

Chris Bennett Over a year ago

thanks I can't believe I missed all of that xD The reason for the form nesting was because I wanted to distinguish between where the user enters the username and where the changed details are entered

Mehdi Karamosly · Accepted Answer · 2013-05-10 22:15:07Z

0

your query should be like below :

$sql3 = "UPDATE `customer` SET `Password`='".$db_password."' 
WHERE `Username`='".$db_username."'";

answered May 10, 2013 at 22:15

Mehdi Karamosly

5,4382 gold badges34 silver badges50 bronze badges

1 Comment

Orangepill Over a year ago

and db_password is not set and there is nested forms going on in the markup... the username field is in its own form so the first warning you are getting is because it's not being posted over

Collectives™ on Stack Overflow

can't update mysql database using php

3 Answers 3

3 Comments

4 Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

3 Comments

4 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related