I'm running the following UPDATE query and having no succes:
$sql="UPDATE users SET firstname='".$_GET['fn']."',lastname='".$_GET['ln']."',email='".$_GET['emadd']."' WHERE id = ".$_GET['id'];
mysql_error(); returns no error, though I'm sure this is a syntax issue.
If you can help me clean this up with an explanation to help me learn where I went wrong it would be much appreciated!
To give a larger point of reference, here is the table creation code:
$sql="CREATE TABLE users
(
id int NOT NULL auto_increment,
PRIMARY KEY(id),
firstname varchar(20),
lastname varchar(20),
email varchar(40)
)";
And here is the entire code from my updater.php which runs the update query on the table:
mysql_select_db(dustin,$con);
$sql="UPDATE users SET firstname='".$_GET['fn']."',lastname='".$_GET['ln']."',email='".$_GET['emadd']."' WHERE id = ".$_GET['id'];
$sherlock=mysql_query($sql,$con);
echo $sql returns the following:
UPDATE users SET firstname='Mike',lastname='Wilson',email='[email protected]' WHERE id =
Does this mean my id is not getting passed over?
To see it live in action, go to 24.77.236.155/dustin/Assignment2/users.php and click edit to play with the query. Also, 24.77.236.155/dustin/Assignment2/add.htm is available to add users to the table.
."' WHERE id = ".$_GET['id'];to."' where id='" . $GET['id] . "'";$_GETvariable data directly into a query is one of the most dangerous, harmful, unsecured things you can do to your site if you're not validating the contents of those values--- I hope you can do something about this.. [ reason for outburst ] -> SQL Injection! :(