Php delete data from sqlite3 from select(from database) option in HTML

Question

<div><select class="form-control"name="old_name"></select></div>
<div><input class="form-control" type="text" name="name" pattern="^[\w\- ]+$"/></div>

Noted that all items in select tag is generated from a javascript using "innerHTML" to update information from database.

There are two elements(old_name, name) in HTML form which using POST method. I want to replace "old_name" with "name" with php. Here is my Php Code.

$orignal_name = $_POST['old_name'];
$q = $db->prepare("UPDATE categories SET name = ? WHERE name = ". $orignal_name);
return $q->execute(array($_POST['name']));

But it did not work. I try to echo "old_name" and the result is "NaN".

Why use a parameter for one name and concatentate a value onto the second??? — RiggsFolly
– RiggsFolly, Commented Dec 2, 2016 at 14:04
because the parameter ? is the input in HTML. Set it as parameter can prevent Injection. While the second value is fixed with select tag. — Hugo
– Hugo, Commented Dec 2, 2016 at 14:05
POSTED data can be spoofed, quite easily. Dont assume the data coming into any script from GET or POST is safe — RiggsFolly
– RiggsFolly, Commented Dec 2, 2016 at 14:07
Also I can edit what is in a <option> tag very easily before submitting a form with almost any browser — RiggsFolly
– RiggsFolly, Commented Dec 2, 2016 at 14:13

RiggsFolly · Accepted Answer · 2016-12-02 14:11:35Z

1

Your actual error is that you did not wrap the $original_name concatenation in quotes, but this would be a better approach

$q = $db->prepare("UPDATE categories SET name = ? WHERE name = ?");

return $q->execute(array($_POST['name'], $_POST['old_name']));

I assume you are checking that both these occurances exist in $_POST and contain data before getting to this code.

edited Dec 2, 2016 at 14:11

answered Dec 2, 2016 at 14:06

RiggsFolly

94.7k22 gold badges108 silver badges152 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

Hugo Over a year ago

I have a AJAX error after I add one more parameter. I am checking where is the error and decided whether accept the solution. Thanks for your help

RiggsFolly Over a year ago

OK, but your question has nothing to do with AJAX as it is asked

RiggsFolly Over a year ago

Actually looking at the HTML you show, the <select> tag does not appear to have an <option> tags inside it. Is that because you just shortened the code or missed that completely

Hugo Over a year ago

all option is generated from a javescript.

Hugo Over a year ago

something like xxxx.innerHTML = '<option></option>' + options.join('');

|

Collectives™ on Stack Overflow

Php delete data from sqlite3 from select(from database) option in HTML

1 Answer 1

6 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Your Answer

Sign up or log in

Post as a guest

Related