Updating Database through PHP

Question

Been trying tirelessly. Searched dozens of threats and no luck. I seem to have an error in my code and I seem to find it.

I'm trying to update a record in my database using sql. When I hit submit the page redirects to the page I set up to display the contents of the table I am trying to update but there is no change.

<?php
/* Database credentials. Assuming you are running MySQL
server with default setting (user 'root' with no password) */
define('DB_SERVER', '###');
define('DB_USERNAME', '###');
define('DB_PASSWORD', '###');
define('DB_NAME', '###');

/* Attempt to connect to MySQL database */
$mysqli = new mysqli(DB_SERVER, DB_USERNAME, DB_PASSWORD, DB_NAME);

// Check connection
if($mysqli === false){
    die("ERROR: Could not connect. " . $mysqli->connect_error);


    }
    $result = mysqli_query($mysqli,"SELECT * FROM appeals");
echo "<article>";

echo "<table class='w3-table-all w3-card-4' width='700' height='300' align='center' border='1'>
<caption><h3>Appeals</h3></caption>
<tr>
<th>Appeal ID</th>
<th>Crime ID</th>
<th>Filing Date</th>
<th>Hearing Date</th>
<th>Status</th>
<th>Update Record</th>
</tr>";

while($row = mysqli_fetch_array($result))
{
echo "<tr>";
echo "<td>" . $row['appeal_ID'] . "</td>";
echo "<td>" . $row['crime_ID'] . "</td>";
echo "<td>" . $row['filing_date'] . "</td>";
echo "<td>" . $row['hearing_date'] . "</td>";
echo "<td>" . $row['status'] . "</td>";
echo "<td style='text-align:center;'><a href='update-appeals.php?id=". $row['appeal_ID'] . "'>UPDATE</a></td>";
echo "</tr>";
}
echo "</table>";

echo "</article>";

echo "<footer>
  <p>Created by: Micah George </p>
</footer>";
echo "</body></html>";

mysqli_close($mysqli);
?>

Cut out some unneeded code for the purpose of shortening post but above sends the id/primary key of the record to be updated to the page that does the updating below. (I know it works because i get the id but I included it in case its needed.)

<?php
/* Database credentials. Assuming you are running MySQL
server with default setting (user 'root' with no password) */
define('DB_SERVER', '###');
define('DB_USERNAME', '###');
define('DB_PASSWORD', '###');
define('DB_NAME', '###');

/* Attempt to connect to MySQL database */
$mysqli = new mysqli(DB_SERVER, DB_USERNAME, DB_PASSWORD, DB_NAME);

// Check connection
if($mysqli === false){
    die("ERROR: Could not connect. " . $mysqli->connect_error);

$id= $_GET ['id'];
if(isset($_POST['save']))
{
    $sql = "UPDATE appeals SET crime_ID = '".$_POST["crime_ID"]."', filing_date = '".$_POST["filing_date"]."', hearing_date = '".$_POST["hearing_date"]."', status = '".$_POST["status"]."' WHERE appeal_ID = '$id'" ;

    $result = mysqli_query($mysqli,$sql);
    header('Location: jailAW-read_appeals.php');
}


echo "<article>";
echo "
<div class='form'>
<form action='update-appeals.php' method='post'>
<label id='first'> Appeal ID: $id </label><br/>
<input type='hidden' name='appeal_ID'><br/>


<label id='first'>Crime ID:</label><br/>
<select name='crime_ID'>";
$result = mysqli_query($mysqli, "SELECT crime_ID, criminal_ID FROM crimes");
while ($row = $result->fetch_assoc()) {
    $id1 = $row['crime_ID'];
    $criminal = $row['criminal_ID']; 
    echo '<option value="'.$id1.'">'.$id1.' - ('.$criminal.')</option>';
}
echo"
</select><br/>


<label id='first'>Filing Date</label><br/>
<input type='date' name='filing_date'><br/>

<label id='first'>Hearing Date</label><br/>
<input type='date' name='hearing_date'><br/>

<label id='first'>Status:</label><br/>
<select name='status'>
  <option value='P'>P</option>
</select><br/><br/>

<button type='submit' name='save' style='width:205px; background-color: green;'>Submit</button>
</div>
</form>";
echo "</article>";

echo "<footer>
  <p>Created by: Micah George </p>
</footer>";
echo "</body></html>";

mysqli_close($mysqli);
?>

New to this so my mistake might be simple but any help is appreciated. (For a final project).

Answer 1

Problem is in this line

<form action='update-appeals.php' method='post'>

Whe your form submits to update-appeals.php there's no $_GET['id'] in URL.

I advise you to add appeal id as a hidden input to your form (id will be available via $_POST['id'] ):

<select name='status'>
  <option value='P'>P</option>
</select><br/><br/>
<input type="hidden" name="id" value="<?=$_GET['id']?>" />

Or modify action url (id will be available as $_GET['id'] ):

<form action='update-appeals.php?id=<?=$_GET['id']?>' method='post'>

And of course move to prepared statements ASAP .