How to update an sql db

Question

I'm making a site using self-made search engine and I want to put people's searchterms ($search) in a database. If $search is already in the database, I want the corresponding number (column Aantal in table) to go up by when. I succeed in adding a new searchterm in the table, but not updating one that is already in. It justs makes a new entry with Aantal = 1. Here's my code, searchterms is the name of the db and table, Zoekterm is the name of the columns were the searchterms go:

Sorry for my poor English :-)

if ($search != null) {
        $conn = new mysqli($servername, $username, $password, $dbname);
    if ("SELECT * FROM searchterms WHERE Zoekterm = '{$search}'"){
            $inserts = "INSERT into searchterms values('". $search . "', '" . 1 . "')";
            if ($conn->query($inserts) === FALSE) {
               echo "Error: " . $inserts . "</ br>" . $conn->error;
        }
    }
    elseif (!"SELECT * FROM searchterms WHERE Zoekterm = '{$search}'") {
        $i = mysqli_query($conn, "SELECT Aantal FROM searchterms WHERE Zoekterm = '{$search}'"); 
        $j = mysqli_fetch_row($i);
        foreach ($j as $k) {
            $k++;
            echo "<p>$k</p>";
        }
        $sql = "UPDATE searchterms SET Aantal='$k' WHERE Zoekterm = '$search'";
    }
    $conn->close();
}

Marc B · Accepted Answer · 2016-07-07 14:14:44Z

1

This is totally wrong:

if ("SELECT * FROM searchterms WHERE Zoekterm = '{$search}'"){

if("string") will ALWAYS evaluate to true - those aren't queries. they're strings that happens to contain some characters that LOOK like sql. That text/sql doesn't become a query until you send it to the database and execute it.

And on top of that, you are vulnerable to sql injection attacks

answered Jul 7, 2016 at 14:14

Marc B

362k44 gold badges433 silver badges508 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

DagelijksGamer Over a year ago

Can you please explain how I have to solve this than?

Marc B Over a year ago

execute those queries. you're already doing it with the insert ones, so I have no idea why you think you can just dump sql into a string and have results magically show up without ever calling ->exec() or ->query()

DagelijksGamer Over a year ago

So I've added $conn->exec($sql); just under the line where I declare $sql, but it still doesn't work... I still have a lot to learn

Collectives™ on Stack Overflow

How to update an sql db

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related