php mysql update

Question

<?php
$host = "localhost";
$user = "root";
$pass = "pass";
$db = "table";
$connect=mysql_connect($host, $user, $pass) or die(mysql_error());
mysql_select_db($db, $connect) or die(mysql_error());
if ($_SERVER["REQUEST_METHOD"] == "POST")
{
  $username = trim($_POST["username"]);
   $res = mysql_query("SELECT id, username, email, ip FROM users WHERE username='". mysql_real_escape_string($username) . "'");

  $arr = mysql_fetch_assoc($res);
  $user_id = $arr['id'];
  $user_name = $arr['username'];
  $user_email = $arr['email'];
  $user_ip = $arr['ip'];
  $res = mysql_query("UPDATE users SET enabled=no WHERE id=$user_id") or mysql_error();
}
?>
<form method="post" action="">
<input type="text" size="40" name="username">
<tr><td colspan="2"><input type="submit" class="btn" value='send'></td></tr>
</form>

This script doesn't execute: $res = mysql_query("UPDATE users SET enabled=no WHERE id=$user_id") or mysql_error();

What's wrong ?

Adnan · Accepted Answer · 2011-04-19 12:19:09Z

7

Use:

$res = mysql_query("UPDATE users SET enabled='no' WHERE id=$user_id") or die(mysql_error());

answered Apr 19, 2011 at 12:19

Adnan

26.4k18 gold badges83 silver badges112 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

fin1te · Accepted Answer · 2011-04-19 12:19:36Z

2

Try wrapping the enabled=no and the id=$user_id in quotes

$res = mysql_query("UPDATE users SET enabled='no' WHERE id='$user_id'") or mysql_error();

You should also make sure you escape your variables as your code is vulnerable to SQL Injection

$username = mysql_real_escape_string(trim($_POST["username"]));

answered Apr 19, 2011 at 12:19

fin1te

4,3121 gold badge21 silver badges16 bronze badges

7 Comments

user254875486 Over a year ago

If the id column is an integer you don't need the single quotes around $user_id

PHP Over a year ago

I have doubt on single quoted $user_id... are you sure?

fin1te Over a year ago

True, but it's best practice - if it's inside quotes and you escape the variable, it can prevent SQL injection

user254875486 Over a year ago

I'm not sure putting integer values in single quotes is best practice.. Why would this be better than without the qoutes?

fin1te Over a year ago

Because of SQL injection reasons, and also on the possibility it isn't an int being passed. If it's wrapped in quotes, then it will just return null, without causing the script to bug out. And with regards to SQL injection, if the variable is '1 OR UNION...' then it's exploitable - if it's wrapped in quotes and escaped, again it will just return null.

|

sdemirkeser · Accepted Answer · 2011-04-19 12:21:03Z

0

you need to debug.

at the end of this line

 $res = mysql_query("UPDATE users SET enabled=no WHERE id=$user_id") or mysql_error();

write this line

"UPDATE users SET enabled=no WHERE id=$user_id"

you will see what command will be execute. probably $user_id variable coming wrong.

if you seen wrong sql command go head and try to investigate why user_id coming wrong

answered Apr 19, 2011 at 12:21

sdemirkeser

4402 gold badges7 silver badges10 bronze badges

Collectives™ on Stack Overflow

php mysql update

3 Answers 3

Comments

7 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

7 Comments

Comments

Your Answer

Sign up or log in

Post as a guest