MySQL INSERT和UPDATE查询不适用于PHP 5.2.17

Question

I'm working on a website with PHP and MySQL, first I use XAMPP to preview the building of my site, everything is working fine here (XAMPP PHP version is 5.7), the problem is when I uploaded through FTP the content of my site, the INSERT and UPDATE queries aren't working on my PHP scripts.

I've read some articles about the compatibility issues between both versions, FTP server is using PHP 5.2.17.

The SELECT queries are working fine in the server, so, login into database is not the issue.

This is my code using UPDATE :

include_once 'db_post.php';
$mysqli = new mysqli(DATA_HOST, DATA_USER, DATA_PASSWORD, DATA_DATABASE);

$catTitle = mysqli_real_escape_string($mysqli, $_POST['catName']);
$catDesc = mysqli_real_escape_string($mysqli, $_POST['catDesc']);
$catID = mysqli_real_escape_string($mysqli, $_GET['ID']); // I get this in the redirection, the value isn't in the POST form

$cT = "UPDATE categorias SET NombreCat = '$catTitle', DescripcionCat = '$catDesc', ImagenCat = 'no_image.png' WHERE IDCat = $catID"; 

if ($mysqli->query($cT) === TRUE) { header("Location: ../management.php?Action=ManageCategories&Edit=Successful"); }
else { header("Location: ../management.php?Action=ManageCategories&Edit=Error"); }

The redirection goes through the error and nothing is saved in the database.

Another info about my DB is that I'm using InnoDB instead of MyISAM, which allegedly is recommended in phpMyAdmin.

Also when I'm trying to insert a row, there's no query:

include_once 'db_post.php';
$mysqli = new mysqli(DATA_HOST, DATA_USER, DATA_PASSWORD, DATA_DATABASE);

$catTitle = mysqli_real_escape_string($mysqli, $_POST['catName']);
$catDesc = mysqli_real_escape_string($mysqli, $_POST['catDesc']);

$cT = "INSERT INTO categorias (IDCat, NombreCat, DescripcionCat, ImagenCat) VALUES (null, '$catTitle', '$catDesc', 'no_image.png')"; 

if ($mysqli->query($cT) === TRUE) { header("Location: ../management.php?Action=ManageCategories&Add=Successful"); }
else { header("Location: ../management.php?Action=ManageCategories&Add=Error"); }

So the question is, which is the correct form to query in MySQL in that version of PHP?

Answer 1

You should be using prepared statements to avoid SQL injection hacks, and you should also be capturing error messages. PDO makes this much easier than mysqli:

include_once 'db_post.php';
$dsn = sprintf("mysql:host=%s;dbname=%s", DATA_HOST, DATA_DATABASE);
$db = new PDO($dsn, DATA_USER, DATA_PASSWORD);

if (empty($_GET["ID"])) {
    $action = "Add";
    $stmt = $db->prepare("INSERT INTO categorias (IDCat, NombreCat, DescripcionCat, ImagenCat) VALUES (null, ?, ?, 'no_image.png')";
    $result = $db->prepare([$_POST["catName"], $_POST["catDesc"]);
} else {
    $action = "Edit";
    $stmt = $db->prepare("UPDATE categorias SET NombreCat = ?, DescripcionCat = ?, ImagenCat = 'no_image.png' WHERE IDCat = ?";
    $result = $stmt->execute([$_POST["catName"], $_POST["catDesc"], $_GET["ID"]]);
}

if ($result === true) {
    header("Location: ../management.php?Action=ManageCategories&$action=Successful");
} else {
    error_log("Database error: " . $stmt->errorInfo());
    header("Location: ../management.php?Action=ManageCategories&$action=Error");
}

Now, if you have an error, just check your logs.