使用$ _GET更新mysql数据库中的多个列

Question

I want to update 3 fields in a row in 3 columns but I don't know how to do it. I already searched google and searcedh here but couldn't find any solution for it. I want to change title, paragraph and category of a blog post using $_GET using this way:

<?php
$id = $_GET['id'];
?>
<div class="middle">
  <div class="content" style="width:100%;">
    <div class="context" style="width:100%">
      <?php
    if(isset($_POST['submit'])){
        $title = $_POST['title'];
        $txt = $_POST['txt'];
$query = ("UPDATE tbl_post SET title='$title' WHERE id=$id");
$query = ("UPDATE tbl_post SET txt='$txt' WHERE id=$id");

when I use only one of $_title or $_txt, it works. But I couldn't find a way to update both fields together and couldnt update category selection.

full code of update.php page :

<?php require_once("config.php"); ?>
<?php require_once("header.php"); ?>
<?php
$id = $_GET['id'];
?>
<div class="middle">
  <div class="content" style="width:100%;">
    <div class="context" style="width:100%">
     <?php
    if(isset($_POST['submit'])){
        $title = $_POST['title'];
        $txt = $_POST['txt'];
   $query = ("UPDATE tbl_post SET title='$title' WHERE id=$id");
    $query = ("UPDATE tbl_post SET txt='$txt' WHERE id=$id");
    $query = ("UPDATE tbl_post SET cat='$cat' WHERE id=$id");

mysql_query($query,$con);
header("location:insert.php");
exit(); 
        }
?>
      <form action="" method="post">
        <?php

      $id = $_GET['id'];

$query = "SELECT * FROM `tbl_post` WHERE(id=$id)";
$res = mysql_query($query,$con);
while($rows = mysql_fetch_array($res,MYSQL_ASSOC)){
?>
        <p>عنوان مطلب</p>
        <input type="text" name="title" style="width:200px; border:1px solid #8C8C8C" value="<?php echo $rows['title'] ?>">
        <p>محتوای پست</p>
        <textarea name="txt" style="width:300px"><?php echo $rows['txt'] ?></textarea>
        <div class="clear"></div>
        <?php } ?>
        <p>دسته بندی</p>
        <select name="cat" style="width:200px">
          <?php

$query = "SELECT * FROM `tbl_cat` ORDER BY `id` ASC";
$res = mysql_query($query,$con);
while($rows = mysql_fetch_array($res,MYSQL_ASSOC)){


?>
          <option value="<?php echo $rows ['id'] ?>"><?php echo $rows ['name'] ?></option>
         </li>
          <?php } ?>
        </select>
        <input type="submit" name="submit" class="" value="ثبت در دیتابیس" style="width:200px; margin-top:15px;">
      </form>
    </div>
  </div>
</div>
<?php require_once("footer.php"); ?>

and insert.php :

<?php require_once("config.php"); ?>
<?php require_once("header.php"); ?>
<div class="middle">
  <div class="content" style="width:100%;">
    <div class="context" style="width:100%">


    <?php
    if(isset($_POST['submit'])){
        $title = $_POST['title'];
        $cat = $_POST['cat'];
        $txt = $_POST['txt'];
        echo 'title = '.$title.'<br>'.'category ='.$cat.'<br>'.'txt = '.$txt;
$query = "INSERT INTO tbl_post(`title`,`txt`,`cat_id`) VALUES  ('$title','$txt','$cat')";   
mysql_query($query,$con);
header("location:insert.php");
exit(); 
        }
?>

 <form action="" method="post">
        <p>عنوان مطلب</p>
        <input type="text" name="title" style="width:200px; border:1px solid #8C8C8C;">
        <p>دسته بندی</p>
        <select name="cat" style="width:200px">
          <?php

$query = "SELECT * FROM `tbl_cat` ORDER BY `id` ASC";
$res = mysql_query($query,$con);
while($rows = mysql_fetch_array($res,MYSQL_ASSOC)){


?>
          <option value="<?php echo $rows ['id'] ?>"><?php echo $rows ['name'] ?></option>
          </li>
          <?php } ?>
        </select>
        <p>محتوای پست</p>
        <textarea name="txt" style="width:300px"></textarea>
        <div class="clear"></div>
        <input type="submit" name="submit" class="" value="ثبت در دیتابیس" style="width:200px; margin-top:15px;">



      </form>
    </div>
  </div>
</div>
<?php require_once("footer.php"); ?>

Answer 1

Combine all the fields into a single query:

$title = $_POST['title'];
$txt = $_POST['txt'];
$cat = $_POST['cat'];

$query = "UPDATE tbl_post SET title='$title', txt = '$txt', cat = '$cat' WHERE id = $id";

Also, you should switch to parametrized queries instead of substituting into the SQL; this means using PDO or mysqli. Otherwise you need to escape the input data. See

How can I prevent SQL injection in PHP?