below is the code for a obe of my pages.. I ',m having a hard time with the code that updates the status of an item .
the code will update the last entry but will not update other entries.
PHP Code:
PHP Code:
<?php
/* Check User Script */
session_start(); // Start Session
include ("../Connections/db.php");
$member_id = $_SESSION['user_id'];
//check if user is already logged in
if (!isset($_SESSION['user_id'])){
$msg = 'You tryed to access a members only page. Login or become a registered member to access that page!';
header("Location: ../index.php?msg=".$msg);
}
//get members ads
$get_ads = ("SELECT * FROM ads WHERE member_id = '$member_id'");
$query = mysql_query($get_ads);
//update status
if(isset($_POST['updateStatus'])){
$ad_id = $_POST['ad_id'];
$new_status = $_POST['updateStatus'];
mysql_query("UPDATE ads SET status = '$new_status', status_date = now() WHERE ad_id ='$ad_id' ");
(1) Why are you assigning $member_id the value of $_SEESION['user_id'] before you check if $_SESSION['user_id'] exists? You should first test for existence, redirect if not and assign if it exists.
(2) Why are you perform the $get_ads query before the UPDATE. It isn't being used before the next IF, which may lead to a redirect.
(3) How many items is the UPDATE expected to update? More than one? If not, use LIMIT 1.
(4) Why aren't you checking the status of the query before you redirect. There might be an error that you'll never see...
Consider changing this part:
PHP Code:
<?php
/* Check User Script */
session_start(); // Start Session
include ("../Connections/db.php");
$member_id = $_SESSION['user_id'];
//check if user is already logged in
if (!isset($_SESSION['user_id'])){
$msg = 'You tryed to access a members only page. Login or become a registered member to access that page!';
header("Location: ../index.php?msg=".$msg);
}
//get members ads
$get_ads = ("SELECT * FROM ads WHERE member_id = '$member_id'");
$query = mysql_query($get_ads) or die("SQL Error: $get_ads<br>" . mysql_error());
//update status
if(isset($_POST['updateStatus'])){
$ad_id = $_POST['ad_id'];
$new_status = $_POST['updateStatus'];
mysql_query("UPDATE ads SET status = '$new_status', status_date = now() WHERE ad_id ='$ad_id' ");
header("Location: treasureList.php");
exit();
}
?>
to this:
PHP Code:
<?php
/* Check User Script */
session_start(); // Start Session
//check if user is already logged in
if (!isset($_SESSION['user_id'])){
$msg = 'You tryed to access a members only page. Login or become a registered member to access that page!';
header("Location: ../index.php?msg=".$msg);
}
include ("../Connections/db.php");
//update status
if(isset($_POST['updateStatus'])){
$ad_id = $_POST['ad_id'];
$new_status = $_POST['updateStatus'];
$sql = "UPDATE ads SET status = '$new_status', status_date = now() WHERE ad_id ='$ad_id' LIMIT 1"
mysql_query($sql) or die("SQL Error: $sql<br>" . mysql_error());
header("Location: treasureList.php");
exit();
}
$member_id = $_SESSION['user_id'];
//get members ads
$get_ads = ("SELECT * FROM ads WHERE member_id = '$member_id' LIMIT 1");
$query = mysql_query($get_ads) or die("SQL Error: $get_ads<br>" . mysql_error());
?>
If your PHP version supports it: yes, usually*.
If not supported, try mysql_escape_string().
If your version doesn't support that either, then addslashes().
Whichever you use, use stripslashes() to get it back.
* Usually means anything that doesn't come from the DB itself and that you're not 100% sure about. If you manually assign: $id = 100; there's no need escaping that, obviously. But $id = $_POST['id']; absolutely should. If you're not sure, escape it...
does mysql_real_escape_string do the same thing as addslashes and strip slashes. I'm kinda confused this is new to mmy web hosting provider offers php 4 and 5 and uses mysql 5
If you have the option to go PHP5, it would've been better and we could have saved a lot of time on some of those subqueries we had to "fabricate"...
addslashes(), mysql_escape_string() and mysql_real_escape_string() essentially do the same thing - with subtle differences.
The first one works anywhere, anytime.
The second one works anywhere, anytime, starting with PHP 4.0.3.
The third one works anywhere, anywhere, AFTER you have connected to a database and starting with PHP 4.3.0.
The manual describes the difference between the last two:
Originally Posted by PHP Manua
This (mysql_escape_string()) function is identical to mysql_real_escape_string() except that mysql_real_escape_string() takes a connection handler and escapes the string according to the current character set. mysql_escape_string() does not take a connection argument and does not respect the current charset setting.
The order of preference, therefore, should be option 3,2,1.
stripslashes(), on the other hand, undoes whatever you did with either of these functions, so that you can deal with your data as it originally was before you stored it in the table.
There's a catch somewhere, though. If you server is configured to automatically escape GPC (GET-POST-COOKIE) variables, before you can apply any of the three "slashing" functions, you may have to strip the slashes and then add slashes. It may not make sense but "magic" quoting that takes places is different than what you need for a database. So, there's no safe remedy other than strip and add slashes. Here's one way to do it:
The use of "mysql_ping()" is certainly overkill but I included it to underline the fact that a database is required for mysql_real_escape_string() to work.
thanks for the info, I'm switching web hosting providers which offers the newer versions of mysql and php for the reason that you and the others give me uses functionality greater then my current web hosting company.
Reply With Quote
Originally Posted by PHP Manua
Bookmarks