MySQL UPDATE查询问题

Question

I have a super easy question. I have a form that echoes out a mySQL record that the user can update. I make my changes, and it tells me that the update is successful, but when I look at the table, the changes do not go through. What is the problem here?

This is the first script.

<?php
require_once("models/config.php");
?>

<table border=1>
 <tr>
<td align=center>Edit Form</td>
  </tr>
  <tr>
   <td>
  <table>
  <?
  $personid=$_SERVER['QUERY_STRING'];

  $order = "SELECT * FROM persons where personid='$personid'";

  $result = mysqli_query($mysqli,$order);
  $row = mysqli_fetch_array($result);
  ?>
  <form method="post" action="edit_data.php">
  <input type="hidden" name="id" value="<? echo "$row[personid]"?>"> 
  <tr>Person ID:<? echo "$row[personid]"?></tr>
    <tr>        
      <td>First Name</td>
      <td>
        <input type="text" name="firstname" 
    size="20" value="<? echo "$row[firstname]"?>">
      </td>
    </tr>
    <tr>
      <td>Surname</td>
      <td>
        <input type="text" name="surname" size="40" 
      value="<? echo "$row[surname]"?>">
      </td>
    </tr>
    <tr>
      <td align="right">
        <input type="submit" 
      name="submit value" value="Edit">
      </td>
    </tr>
     </form>
    </table>
    </td>
 </tr>
  </table>
  </body>
  </html>

Which then goes through to this:

<?
require_once("models/config.php");

 $personid = $_POST['personid'];
 $firstname = mysqli_real_escape_string($mysqli, htmlspecialchars($_POST['firstname']));
 $surname = mysqli_real_escape_string($mysqli, htmlspecialchars($_POST['surname']));

 $order = "UPDATE persons SET firstname='$firstname', surname='$surname' WHERE   personid='$personid'";
$result = mysqli_query($mysqli,$order);
 if (!$result) {
echo "Error entering data! <BR>";
echo mysql_error();
} else {
echo "User updated to $firstname $surname <BR>";
}
?>

Is there something I am missing here?

Thanks in advance.

Answer 1

You are sending a hidden input named id and trying to use a $_POST['personid'] correct that

You may also pay attention to the comments you had (SQL Injection's one at least)