使用POST通过HTML表单更新值将检索旧值

Question

I'm working on a CRUD system and currently, I am in the Update section. I have old values from users that need to be updated to new ones through an HTML form.

Right now I am trying to retrieve the POST values from the HTML form set to the post method. After that, I update the user info with the new values gained from the POST request.

<?php
$oldId = $_GET['id'];
$conn = mysqli_connect('localhost', 'root', '')
or die('Verbinding met database server is mislukt.');
mysqli_select_db($conn, 'crudopdracht')
or die('De database is niet beschikbaar');
$query = "SELECT * FROM gebruikers WHERE id = $oldId";
$result = mysqli_query($conn, $query)
or die (mysqli_error($conn));
while ($row = mysqli_fetch_assoc($result)){
    $naam = $row['naam'];
    $leeftijd = $row['leeftijd'];
    $gender = $row['gender'];
    $locatie = $row['locatie'];
};
?>
<form action="" method="post">
    <label for="id">ID:</label><br>
    <input type="text" id="id" name="id" <?php echo 'placeholder="' . $oldId . '"><br>';?>
    <label for="naam">Naam:</label><br>
    <input type="text" id="naam" name="naam" <?php echo 'placeholder="' . $naam . '"><br>';?>
    <label for="leeftijd">Leeftijd:</label><br>
    <input type="text" id="leeftijd" name = "leeftijd" <?php echo 'placeholder="' . $leeftijd . '"><br>';?>
    <label for="gender">Geslacht:</label><br>
    <input type="text" id="gender" name="gender" <?php echo '[placeholder="' . $gender . '"><br>';?>
    <label for="locatie">Locatie:</label><br>
    <input type="text" id="locatie" name = "locatie" <?php echo 'placeholder="' . $locatie . '"><br><br>';?>
    <input type="submit" value="Verstuur" id="submit" name="submit">
</form>
</div>
<?php
if(isset($_POST["submit"])){
    echo 'hello';
    $id = $_POST["id"];
    $naam = $_POST["naam"];
    $leeftijd = $_POST["leeftijd"];
    $gender = $_POST["gender"];
    $locatie = $_POST["locatie"];
    $query2 = "UPDATE gebruikers SET id = $id, naam = $naam, leeftijd = $leeftijd, gender = $gender, locatie = $locatie WHERE id = $oldId";
    mysqli_query($conn,$query2);
}
?>

In my opinion, I expect the values to change to the new ones set in the HTML form, but they always return the old values.

Answer 1

SQL injection issues aside (as you've stated it isn't in scope of the particular issue), you need to correctly format your SQL query for any non-integer values, so that they are encapsulated with quotes ('[value]').

Your query would current run as:

UPDATE gebruikers ( id = somevalue, naam = somevalue, leeftijd = somevalue, gender = somevalue, locatie = somevalue WHERE id = 12345`

In this query, SQL would attempt to interpret your values as entities (columns, tables), which is obviously not what you want.

So, although you should never inject user input values into a query, the following should fix your issue:

Change

$query2 = "UPDATE gebruikers SET id = $id, naam = $naam, leeftijd = $leeftijd, gender = $gender, locatie = $locatie WHERE id = $oldId";

to

$query2 = "UPDATE gebruikers SET id = $id, naam = '$naam', leeftijd = '$leeftijd', gender = '$gender', locatie = '$locatie' WHERE id = $oldId";`

Assuming id is an INT field, and the others are strings.