This is my php code:
if (isset($_POST['data']) && is_array($_POST['data'])) {
foreach ($_POST['data'] as $row => $data) {
$result = mysql_query("UPDATE orders SET project_ref='".$data['project_ref']."' where order_id = '".$data['order_id']."'") or die(mysql_error());
$result1 = mysql_query("UPDATE orders SET supp_short_code='".$data['supp_short_code']."' where order_id = '".$data['order_id']."'") or die(mysql_error());
$result2 = mysql_query("UPDATE orders SET om_part_no='".$data['om_part_no']."' where order_id = '".$data['order_id']."'") or die(mysql_error());
$result3 = mysql_query("UPDATE orders SET description='".$data['description']."' where order_id = '".$data['order_id']."'") or die(mysql_error());
$result4 = mysql_query("UPDATE orders SET quantity='".$data['quantity_input']."' where order_id = '".$data['order_id']."'") or die(mysql_error());
$result5 = mysql_query("UPDATE orders SET cost_of_items='".$data['cost_of_items']."' where order_id = '".$data['order_id']."'") or die(mysql_error());
$result6 = mysql_query("UPDATE orders SET cost_total='".$data['cost_total_td']."' where order_id = '".$data['order_id']."'") or die(mysql_error());
}
}
So when the user wants to edit order id: 1, i hope it will update all rows where the order_id is 1, but what this code is doing is setting all fields to "1"??
EDIT:
This is how i'm sending the data to the PHP:
$('#submit').live('click',function(){
var postData = {};
postData['data[order_id]'] = $('#order_id').text();
$('#items tr').not(':first').each(function(index, value) {
var keyPrefix = 'data[' + index + ']';
postData[keyPrefix + '[supp_short_code]'] = $(this).closest('tr').find('.supp_short_code').text();
postData[keyPrefix + '[project_ref]'] = $(this).closest('tr').find('.project_ref').text();
postData[keyPrefix + '[om_part_no]'] = $(this).closest('tr').find('.om_part_no').text();
postData[keyPrefix + '[description]'] = $(this).closest('tr').find('.description').text();
postData[keyPrefix + '[quantity_input]'] = $(this).closest('tr').find('.quantity_input').val();
postData[keyPrefix + '[cost_of_items]'] = $(this).closest('tr').find('.cost_of_items').text();
postData[keyPrefix + '[cost_total_td]'] = $(this).closest('tr').find('.cost_total_td').text();
});
$.ajax
({
type: "POST",
url: "updateorder.php",
dataType: "json",
data: postData,
cache: false,
success: function()
{
alert("Order Updated");
}
});
});
you can start by reading this which will save you lots of trouble in the future.
Also, you don't need to create a query for each field you need to update. Disregarding security issues, you can do something like:
$q = "
UPDATE orders
SET project_ref='".$data['project_ref']."' ,
supp_short_code='".$data['supp_short_code']."' ,
om_part_no='".$data['om_part_no']."' ,
description='".$data['description']."' ,
// .... remaining fields here, don't forget ^ the coma
WHERE order_id = '".$data['order_id']."'
";
mysql_query($q) or die(mysql_error());
What this code is doing is setting your table fields project_ref, supp_short_code, om_part_no, ...
to something (which comes from $_POST['data']
) to whatever order_id
comes from $_POST['data']['order_id']
.
If all your fields are becoming 1, you probably have some trouble at the data you send from the form. Try a print_r($_POST)
to help you fix it.
$_POST
data is usually provided by the user, so there's no way it's a native PHP array unless you make it yourself ( $_POST['data'] = array()
).
Sanitize your input, and log it before running any query... print_r($_POST['data'])
... be sure it contains the data that you actually want.
Maybe check out the DB Type for order_id in MySQL. I assume that it's defined as an INT. If so, remove the single quotes here:
where order_id = ".$data['order_id']."
Well first of all, is $_POST['data'] an array of arrays? Seems a bit odd to me. A foreach loop iterates through each item in the array, and retrieves the key and value after the as
. So is this what you meant?
if (isset($_POST['data']) && is_array($_POST['data'])) {
foreach ($_POST['data'] as $row => $data) {
$result = mysql_query("UPDATE orders SET $row='$data' WHERE order_id = '" . $_POST['data']['order_id'] . "';");
}
}
Second point is that you shouldn't create a new SQL query for each field. Try this:
if (isset($_POST['data']) && is_array($_POST['data'])) {
$sql = "UPDATE orders SET ";
foreach ($_POST['data'] as $row => $data) {
$sql .= "$row = '$data'";
}
}
$sql .= " WHERE order_id = '" . $_POST['data']['order_id'] . "'";
$result = mysql_query($sql);
And thirdly, read up on SQL injection. At the very minimum, put mysql_real_escape_string() around the $row and $data variables and the $_POST['data']['order_id']. So:
if (isset($_POST['data']) && is_array($_POST['data'])) {
$sql = "UPDATE orders SET ";
foreach ($_POST['data'] as $row => $data) {
$sql .= "mysql_real_escape_string($row) = 'mysql_real_escape_string($data)'";
}
}
$sql .= " WHERE order_id = '" . mysql_real_escape_string($_POST['data']['order_id']) . "'";
$result = mysql_query($sql);
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.