how to change specific record from database using html table

Question

Riu 2009 0 Junior Poster

14 Years Ago

Hi everyone..im new to php and dont know much about my sql as well.actually i have displayed a mysql table from database to my webpage using php.now i've got a seperate list of teachers with thier data(firstname, last name,email, type).what i want is to edit a specific record from the table and want to change the record of that teacher when i press edit button of that specific teacher.or delete the same teacher when i press the delete button.here is my code.its not showing me the specific teacher's record but only showing the first row record of the database. please help me to understand and solve this problem.thankx in advance

this is teachers-list.php

<?php include("../includes/config.php"); ?>
<!DOCTYPE HTML>
<html>
<head>
<title>Admdin Home</title>
<link rel="StyleSheet" href="css/style.css" type="text/css" media="screen">
</head>
<body>
<?php include("includes/header.php"); ?>
<?php include("includes/nav.php"); ?>
<?php include("includes/aside.php"); ?>
<div id="maincontent">

    <div id="breadcrumbs">
        <a href="">Home</a> >
        <a href="">Manage Users</a> >
        List Users
    </div>
    <h2>Teachers List</h2>
</div>
<?php
 if ($_SESSION["isadmin"])
   {

   $con=mysql_connect($dbserver,$dbusername,$dbpassword);
if (!$con)
    {
   die('Could not connect: ' . mysql_error());

    }



mysql_select_db($dbname, $con);
$result = mysql_query("SELECT * FROM accounts WHERE (type='T')");
echo "<table border='1'>
<tr>
<th>E-mail</th>
<th>Firstname</th>
<th>Lastname</th>
<th>Type</th>
<th>EDIT</th>
<th>DELETE</th>
</tr>";

while($row = mysql_fetch_array($result))
  {
  echo "<tr>";
        echo "<td>" . $row['email'] . "</td>";
        echo "<td>" . $row['firstname'] . "</td>";
        echo "<td>" . $row['lastname'] . "</td>";
        echo "<td>" . $row['type'] . "</td>";
        echo "<td><a href='edit-teacher.php'>EDIT</a></td> <td><a href='edit-teacher.php'>DELETE</a></td>";

  echo "</tr>";
  }
    echo "</table>";

mysql_close($con);
?>

</body>
<?php include("includes/footer.php"); ?>
</html>
<?php
    }
    else
    {
        header("Location: ".$fullpath."login/unauthorized.php");

    }
?>

this is edit-teacher.php

<?php include("../includes/config.php"); ?>
<?php
 if ($_SESSION["isadmin"])
   {

   $con=mysql_connect($dbserver,$dbusername,$dbpassword);
if (!$con) { die('Could not connect: ' . mysql_error()); }

mysql_select_db($dbname, $con);

$result = mysql_query("SELECT * FROM accounts WHERE (id=".$_SESSION["id"].")");


    while($row = mysql_fetch_array($result))
    {
       $firstname = $row['firstname'];
       $lastname = $row['lastname'];
       $email=$row['email'];
       $type=$row['type'];
    }



mysql_close($con);
?>
<!DOCTYPE HTML>
<html>
<head>
<title>Change Password</title>
<link rel="StyleSheet" href="../admin/css/style.css" type="text/css" media="screen">
</head>


<body>
<?php include("../admin/includes/header.php"); ?>
<?php include("../admin/includes/nav.php"); ?>
<?php include("../admin/includes/aside.php"); ?>
<div id="maincontent">

    <div id="breadcrumbs">
        <a href="">Home</a> >
         <a href="">Manage Users</a> >
         <a href="">List Users</a> >
         Edit Teacher
    </div>
    <h2>Edit Teacher</h2>


<?php
if (isset($_GET["status"]))
{
    if ($_GET["status"]==1)
    {
        echo("<strong>Teacher Has been Successfully Edited!</strong>");
    }
}
?>
    <form method="post" action="edit-teacher-action.php">
        <label>First Name:</label> <input type="text" value="<?php echo $firstname; ?>" name="Fname" />
        <label>Last Name:</label> <input type="text" value="<?php echo $lastname; ?>" name="Lname" />
        <label>Email:</label> <input type="text" value="<?php echo $email; ?>" name="email" />
        <label>Type:</label>  <input type="text" value="<?php echo $type; ?>" name="type" />

        <input type="submit" value="Edit" />
    </form>



</div>

</body>
<?php include("../admin/includes/footer.php"); ?>
</html>
<?php
   }
    else
    {
        header("Location: ".$fullpath."login/unauthorized.php");

    }
?>

this is edit-teacher-action.php

<?php include("../includes/config.php");?>
<?php
$Fname=$_POST["Fname"];
$Lname=$_POST["Lname"];
$email=$_POST["email"];
$type=$_POST["type"];

$con=mysql_connect($dbserver,$dbusername,$dbpassword);
if (!$con) { die('Could not connect: ' . mysql_error()); }


 mysql_select_db($dbname, $con);
$query=("UPDATE accounts SET firstname='".$Fname."' , lastname='".$Lname."' email='".$email."' type='".$type."' WHERE id=".$_SESSION['id']);
$result = mysql_query($query);
header("Location: edit-teacher.php?status=1");
mysql_close($con);
?>

mysql php

3 Contributors
5 Replies
252 Views
1 Day Discussion Span
Latest Post 14 Years Ago Latest Post by Riu 2009

Dani AI

Generated 8 Months Ago

The core problem is that the listing's Edit/Delete links do not identify which record to edit, while the edit page and action rely on the session id. That combination will always load/update the same account. correctly spotted the malformed UPDATE, and @diafol's point about escaping/parameterized queries is important for security and future-proofing.

Fix checklist (minimal, reliable changes):

Pass the row id from the list to the edit page (add an id query parameter for each row) and read it with server-side validation (cast to int) instead of using the admin session id.
```
// in the loop that prints each teacher row
echo '<a href="edit-teacher.php?id=' . $row['id'] . '">Edit</a>';
```
On edit-teacher.php: read and validate the GET id, fetch that record, and escape output into the form with htmlspecialchars. Add the record id as a hidden form field so edit-teacher-action.php knows which record to update.

On edit-teacher-action.php: use the posted id (not $_SESSION['id']) and a parameterized update (mysqli or PDO). Example with mysqli prepared statements:

$stmt = $mysqli->prepare('UPDATE accounts SET firstname=?, lastname=?, email=?, type=? WHERE id=?');
$stmt->bind_param('ssssi', $first, $last, $email, $type, $id);
$stmt->execute();

Extra notes and cautions:

Keep the admin/authorization check server-side before SELECT/UPDATE for the given id.
After update, redirect to the listing or to edit-teacher.php?id=... (include id if staying on the edit page) to avoid losing context.
Sanitize/validate all inputs, check statement errors/affectedrows during debugging, and migrate away from deprecated mysql* to mysqli or PDO with prepared statements.
For deletes use POST (plus a CSRF token) and confirm the action.

Applying the id-in-links + using the posted id in the update will stop the first-row-only behavior and, combined with 's syntax fix and @diafol's security advice, will make the feature correct and safer.

All 5 Replies

Member #120589

14 Years Ago

Also you MUST sanitize your POST variables with mysql_real_escape_string if using mysql. Alternatively, you can use a parameterized query by using mysqli or PDO. Moving to either of these may be beneficial anyway as mysql is coming to the end of its time.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

pawan768 0 Newbie Poster · Answer 1 · 2012-08-26T12:12:38+00:00

$query=("UPDATE accounts SET firstname='".$Fname."' , lastname='".$Lname."' email='".$email."' type='".$type."' WHERE id=".$_SESSION['id']);

I think error cause due to above given code , just change it as:

query=("UPDATE accounts SET firstname='$Fname' , lastname='$Lname', email='$email', type='$type' WHERE id='$_SESSION[id]'");
mysql_query($query);

Riu 2009 0 Junior Poster · Answer 2 · 2012-08-26T14:40:40+00:00

pawan786 thankyou very much for the support but tell me one thing shouldnt i write it as

$query=("UPDATE accounts SET firstname='$Fname' , lastname='$Lname', email='$email', type='$type' WHERE id='$_SESSION[id]'");
mysql_query($query);

Riu 2009 0 Junior Poster · Answer 3 · 2012-08-26T14:43:39+00:00

@diafol i really dont know about that...but in my whole project i've used these...and now iam in middle of it..how would be the better way to quit the old practices and start the ones u r telling...

thankyou for such a helpful advice

Riu 2009 0 Junior Poster · Answer 4 · 2012-08-26T14:52:30+00:00

well i have changed what u told me..but i think you are not getting what iam saying..the code is not giving any error...in the html table i've made a edit and a delete button in front of evry record..or every row..to edit the user or delete it..but it is only editing the first row and also showing the records of 1st row only whenevr i click the edit button of any row...

how to change specific record from database using html table

Dani AI

Recommended Answers Collapse Answers

All 5 Replies

Recommended Answers