SQL UPDATE select w/ multiple to a PHP array

Question

I'm aware of the SQL injection issues in this code. I am however focusing on just trying to get form to update the mySQL server. I have two select boxes that are populated. I can transfer the equipment back and forth between the two. However when I go to update It does not work. PLEASE HELP ME!

HERE is FORM:

$connection = mysql_connect('#', '#', '#'); 
mysql_select_db('#');

$techequipment = "SELECT serial, type_id FROM tbl_assets WHERE user_id = {$_GET ['TechID']} AND date_installed IS NULL AND date_returned IS NULL AND metro_date_returned IS NULL ORDER BY type_id, serial";
$techresult = mysql_query($techequipment);

$jobequipment = "SELECT serial, type_id FROM tbl_assets WHERE account_number = {$_GET ['JobNum']} ORDER BY type_id, serial";
$jobresult = mysql_query($jobequipment);

$link = array($_GET ['JobNum'])
?>
<title>Assign Equipment</title>
<table align="center">
<form action="assigned_equipment.php?<? echo http_build_query($link)?>" method="POST">
<tr>    
<td><center><b><?php echo "Tech #"; echo $_GET ['TechID']; echo " Assigned Equipment"; ?></b></center></td> 
<td></td>   
<td><center><b><?php echo "Job #"; echo $_GET ['JobNum']; echo " Assigned Equipment"; ?></b></center></td>  
</tr>

<tr>
<td>
<select  name="tech[]" size=20 multiple   id="list1"  STYLE="width: 350px">
<?php $i=0; while($row = mysql_fetch_array($techresult)) { ?>
<option value="<?=$row["serial"];?>"> <?=$row["type_id"]." - ".$row["serial"];?></option>
<?php $i++; } ?> </select>  
</td>

<td>
<center><input type="button" id="btnAdd" value="Transfer >>"/></center>
<center><input type="button" id="btnRemove" value="<< Transfer"/></center>
</td>

<td>
<select  name="job[]" size=20 multiple   id="list2"  STYLE="width: 350px">
<?php $i=0; while($row = mysql_fetch_array($jobresult)) { ?>
<option value="<?=$row["serial"];?>"> <?=$row["type_id"]." - ".$row["serial"];?></option>
<?php $i++; } ?> </select>  
</td>
</tr>

<tr>
<td colspan="2">
</td>

<td>
<center><input type="submit" value="SUBMIT"/></center>
</form>
</td>   

</tr>   
<tr>
<td colspan="3">
<center>Multi Select: Press & hold [CTRL] while clicking on the items.</center>
</td>
</tr>

<tr>
<td colspan="3">
<center><a href="jobs.php">EXIT</a></center>
</td>
</tr>

</table>



<script src="js/jquery-2.2.0.js" type="text/javascript"></script>

<script type="text/javascript">
    $(document).ready(
        function () {

//TAKE EQUIPMENT FROM TECH AND PUT IT IN JOB BOX            
            $('#btnAdd').click(
                function (e) {
                    $('#list1 > option:selected').appendTo('#list2');
                    e.preventDefault();
                });


//TAKE EQUIPMENT FROM JOB AND PUT IT IN TECH BOX
                $('#btnRemove').click(
                function (e) {
                    $('#list2 > option:selected').appendTo('#list1');
                    e.preventDefault();
                });
        });
</script>

Here is my assigned_equipment.php file:

<?php

$connection = mysql_connect('#', '#', '#')
    or die('Could not connect: ' .mysql_error());
mysql_select_db('#');

$equipmentquery="UPDATE tbl_assets SET date_installed = curdate(), account_number = {$_GET['0']} WHERE serial = $_POST['job']";

$techquery="UPDATE tbl_assets SET date_installed = curdate(), account_number = {$_GET ['0']} WHERE serial = $_POST['tech']";

?>

Answer 1

Ok, you are right it seems to be the case that "0" is a valid variable name to submit via $_GET or $_POST. So this is not a problem.

But your problem is that $_POST['job'] is an array.

You try to do this:

$equipmentquery = ""
. "UPDATE tbl_assets "
. "SET date_installed = curdate(), "
. "account_number = {$_GET['0']} "
. "WHERE serial = $_POST['job']";

While $_POST['job'] is an array you cannot do it like this!

Please try the following:

$jobnum = (int)$_GET['0'];
$job_arr = $_POST['job'];

if(($jobnum > 0) && is_array($job_arr) && (count($job_arr) > 0)) {

    $equipmentquery = ""
        . "UPDATE tbl_assets "
        . "SET date_installed = curdate(), "
        . "account_number = ".$jobnum." "
        . "WHERE "
        . 'serial IN ("'.implode('","',$job_arr).'") ';
}

Ok what happens here?

I suspect that your serial holds the values posted in job array. So you want to update each row where your serial matches the posted values in your array.

In case of your $_POST: Array ( [job] => Array ( [0] => gi4416ncd876 [1] => GI4521NA3391 [2] => M40719GD6274 [3] => PAEH01734539 ) ) and your $_GET: Array ( [0] => 113852 ) it will result in the following query:

UPDATE tbl_assets 
SET date_installed = curdate(),
account_number = 113852 
WHERE serial IN ("gi4416ncd876","GI4521NA3391",
"M40719GD6274","PAEH01734539")

Ok now you have a working query. Not it is time to execute it!!!

therefore you need to:

$result = mysql_query ( $equipmentquery );

this is the important line, you are missing!

Finally your code may look like this:

<?php

$connection = mysql_connect('#', '#', '#')
    or die('Could not connect: ' .mysql_error());
mysql_select_db('#');

$jobnum = (int)$_GET['0'];
$job_arr = $_POST['job'];
$tech_arr = $_POST['tech'];

if(($jobnum > 0) && is_array($job_arr) && (count($job_arr) > 0)) {

    $equipmentquery = ""
        . "UPDATE tbl_assets "
        . "SET date_installed = curdate(), "
        . "account_number = ".$jobnum." "
        . "WHERE "
        . 'serial IN ("'.implode('","',$job_arr).'") ';

    $result1 = mysql_query ( $equipmentquery );

}
if(($jobnum > 0) && is_array($tech_arr) && (count($tech_arr) > 0)) {

    $techquery = ""
        . "UPDATE tbl_assets "
        . "SET date_installed = curdate(), "
        . "account_number = ".$jobnum." "
        . "WHERE "
        . 'serial IN ("'.implode('","',$job_arr).'") ';

    $result2 = mysql_query ( $techquery );

}

When this works, you should directly switch to mysqli or pdo! mysql_ functions are deprecated and not present any more in the latest php version! You should really care about sql injection! So use prepared statements to clean up your input data!!! There are various tutorials out there!!! DO NOT USE THIS CODE IN A LIVE ENVIRONMENT