JSONParser不更新MySQL数据库

Question

I have a List that includes Values for my MySQL Databse. The values are transfered with the list, but when i have a look in my variables (in Debug Mode). I see that just the old values are sended to the PHP Files and not the "updated" Values.

Here i get the old value of "likes":

  protected String doInBackground(String... params) {

        // updating UI from Background Thread
        runOnUiThread(new Runnable() {
            public void run() {
                // Check for success tag
                int success;
                try {
                    // Building Parameters
                    List<NameValuePair> params = new ArrayList<NameValuePair>();
                    params.add(new BasicNameValuePair("id", cid));

                    // getting product details by making HTTP request
                    // Note that product details url will use GET request
                    JSONObject json = jParser.makeHttpRequest(url_details, "GET", params);

                    // check your log for json response
                    Log.d("Details Song", json.toString());

                    // json success tag
                    success = json.getInt(TAG_SUCCESS);
                    if (success == 1) {
                        // successfully received product details
                        JSONArray chartsObj = json.getJSONArray(TAG_CHARTS); // JSON Array

                        // get first product object from JSON Array
                        JSONObject charts = chartsObj.getJSONObject(0);

                        // product with this id found
                        // Edit Text
                        txtInterpret = (TextView)findViewById(R.id.tblInterpret);
                        txtTitel = (TextView)findViewById(R.id.tblTitel);
                        txtAlbum = (TextView)findViewById(R.id.tblAlbum);
                        txtLikes = (TextView)findViewById(R.id.like);
                        thumb_image = (ImageView)findViewById(R.id.albumcover); 

                        imageLoader = new ImageLoader(getApplicationContext());
                        imageLoader.DisplayImage(charts.getString(TAG_ALBUMCOVER), thumb_image);
                        txtInterpret.setText(charts.getString(TAG_INTERPRET));
                        txtTitel.setText(charts.getString(TAG_TITEL));
                        txtAlbum.setText(charts.getString(TAG_ALBUM));
                        txtLikes.setText(Integer.toString(charts.getInt(TAG_LIKES)));
                        likes = charts.getInt(TAG_LIKES);

                    }else{
                        // product with id not found
                    }
                } catch (JSONException e) {
                    e.printStackTrace();
                }
            }
        });

        return null;
    }

This function is in my OnCreate function. When you click on a button you shall increase the int value by one!

        like.setOnClickListener(new View.OnClickListener() {

            @Override
            public void onClick(View v) {
                System.out.println("Vorher: " +likes);
                likes = (likes++);
                System.out.println("Nachher: " +likes);
                new Like().execute();
            }
        });

That is the function with my list.

protected String doInBackground(String... args) {

         List<NameValuePair> params = new ArrayList<NameValuePair>();
         params.add(new BasicNameValuePair("id", cid));
         params.add(new BasicNameValuePair(TAG_LIKES, Integer.toString(likes)));

    // getting JSON Object
    // Note that create product url accepts POST method
         JSONObject json = jParser.makeHttpRequest(url_like,"POST", params);

    // check log cat for response
    Log.d("Create Response", json.toString());

    return null;
    }

This is my JSONParser:

if(method == "POST"){
            // request method is POST
            // defaultHttpClient
            DefaultHttpClient httpClient = new DefaultHttpClient();
            HttpPost httpPost = new HttpPost(url);
            httpPost.setEntity(new UrlEncodedFormEntity(params));

            HttpResponse httpResponse = httpClient.execute(httpPost);
            HttpEntity httpEntity = httpResponse.getEntity();
            json = EntityUtils.toString(httpEntity, HTTP.UTF_8);
            System.out.println("JSON: " + json);

and finally my PHP File:

<?php

/*
 * Following code will update a product information
 * A product is identified by product id (pid)
 */

// array for JSON response
$response = array();

// check for required fields
if (isset($_POST['likes']) && isset($_POST['id'])) {

$id = $_POST['id'];
$likes = $_POST['likes'];

// include db connect class
require_once (connection);

// connecting to db
$db = new DB_CONNECT();

// mysql update row with matched pid
$result = mysql_query("UPDATE Charts SET likes = '$likes' WHERE id = '$id'");

// check if row inserted or not
if ($result) {
    // successfully updated
    $response["success"] = 1;
    $response["message"] = "Like erfolgreich";

    // echoing JSON response
    echo json_encode($response);
} else {

}
} else {
// required field is missing
$response["success"] = 0;
$response["message"] = "Ein Fehler ist aufgetreten";

// echoing JSON response
echo json_encode($response);
}
?>

Answer 1

You're vulnerable to SQL injection attacks, and it's almost guaranteed that the JSON text will contain two of more ' characters, "breaking" your sql query. In essence, you're injecting your own sql query.

You also have no error handling on your queries, and are assuming they succeed. This is very bad. Even if your SQL syntax was 100% perfect, there are far too many OTHER reasons for queries to fail to NOT check for errors:

At bare minimum, you should have

$safe_json = mysql_real_escape_string($_POST['likes']);
$sql = "UPDATE .... WHERE likes='$safe_json' ...";
$result = mysql_query($sql) or die(mysql_error());

And as a general tip, the mysql_*() functions have been deprecated as of PHP 5.4. You should consider switching to mysqli, or preferably PDO.