Need a little help with my script please

[Liam]

My script is:
http://pastebin.com/6duKz2cS

Database structure print screen: Screenshot by Lightshot
If someone could spoonfeed or tell me what I did wrong, please let me know.

The script basically just updates the data in the row, that's really all.. It's for a advertisement script I'm coding (the actual display of the advertisements are done..) now it's just the panel I need to get done!

 

[TimeBomb]

Can you tell us what you want the working script to do and explain what it does now and why it's broken/problematic?

 

[Liam]

Well to put it simple, I just need the script to be able to pull the users advertisement slots that they've purchased, and allow them to edit their image and URL - The image being the advertisement and the URL is the link they click on the ad.. And the problem is, when I click save, it isn't saving the updates to the database, instead it's just reloading the page and saying it updated (in the update echo message, when it didn't..

 

[TimeBomb]

It's late here, so I may just be blindly missing something, but I don't see anything that sticks out like a sore thumb. You're going to need to do a bit of debugging. Echo your $id, $image, and $url (right below line 17) and see what they are. You can also echo mysql_error() after the query is run in case there was a mysql error. Check everything and make sure it appears valid. Something's obviously not right.

Also, on a slightly different note, your current script is very susceptible to SQL injection. In other words, anyone can run any query to your database that they want, even deleting all the tables. You can google SQL injection to learn more about it. Use parametrized queries, also known as prepared statements, to ensure that any and all user input isn't able to inject into your database. See:
mysqli prepared statements
PDO prepared statements

 

[Liam]

It's late here, so I may just be blindly missing something, but I don't see anything that sticks out like a sore thumb. You're going to need to do a bit of debugging. Echo your $id, $image, and $url (right below line 17) and see what they are. You can also echo mysql_error() after the query is run in case there was a mysql error. Check everything and make sure it appears valid. Something's obviously not right.

Also, on a slightly different note, your current script is very susceptible to SQL injection. In other words, anyone can run any query to your database that they want, even deleting all the tables. You can google SQL injection to learn more about it. Use parametrized queries, also known as prepared statements, to ensure that any and all user input isn't able to inject into your database. See:
mysqli prepared statements
PDO prepared statements

I shall try some debugging, forgot about that!

And as for protection to stop injection, I already knew as I was going to do that last once I got everything working and up live Thanks though!

All the debugging is coming back fine, no problems. I don't understand why it isn't saving into the database, not to mention once I click save, the image URL turns into a 0.. You'll notice at the top of the page, the debugging, the first is ID of the row, second is ment to be the image (i tried updating the domain, as it shows a 0) and the last is the URL.
Screenshot by Lightshot

And: Screenshot by Lightshot

Not sure on what the problem could be

 

[TimeBomb]

 <?php session_start(); if (!$_SESSION["valid_user"]) { // User not log - Pastebin.com[/url]
I added a few things to help debug all the values you're receiving. Try to use the form like you intend, and then, instead of saying the Update successful message, it should give you all the values of the variables and some other things. Copy paste all that here in a reply.

 

[jur13n]

uploads .php shell

 

[Liam]

@TimeBomb, I appreciate your help, a lot! Cheers.

The debug is as follows:

string(1) "2" string(40) "http://static.*******/advert/300x250.png" string(17) "http://google.com" string(0) ""

And it's still not updating for some reason! The image URL box just updates and turns into a 0..

 

[Liam]

I've been trying to look around, but I just can't seem to find the mistake I'm making. :/

 

[TimeBomb]

Odd, I don't see anything bad at first glance. Try escaping each of the variables going into the query. Like this:

 <?php session_start(); if (!$_SESSION["valid_user"]) { // User not log - Pastebin.com[/url]

Note that you should be using prepared statements via mysqli or PDO with user input, as I explained earlier. I'm only using mysql_escape_string because it's the fastest solution (and we're just debugging here).

 

[Liam]

I don't know how to do prepared statements or all that stuff, nor do I know how they work, unfortunately, I'm still all old school :/ And it's still not working, not sure why!! It keeps just updating the textbox as a "0" once I click save, I don't know why... I can't see where I went wrong!

 

[Liam]

Any help, anyone?

 

[Liam]

Well, I've completley re-coded it, the same way, checking over all the code bits by bits.... But I am still getting the same damn problem, it won't update to the desired input.. When I try update it, the image URL updates itself to a "0" and the URL won't update. I am really confused, why isn't it working -_- There's no errors, no nothing!

 

[TimeBomb]

Post all the code, and dump your SQL table so we can install the table and test it locally.

 

[Liam]

I have a feeling it has to do with the database :/
Edit.php:

 <?php // Include the required files include('dbConfig.php'); if (isset($_PO - Pastebin.com[/URL]

dbConfig.php:
[URL="http://pastebin.com/UBjaW7hd"][PHP] <?php // Replace the variable values below // with your specific database info - Pastebin.com[/URL]

Database:
[URL="http://pastebin.com/Sgz9XGF4"][MySQL] -- phpMyAdmin SQL Dump -- version 4.0.5[/URL]

Your help is appreciated, cheers :)

 

[Dave]

You should learn how to write queries first, also, execute the queries in PHPMyAdmin so you can see if it's working. MySQL :: MySQL 5.0 Reference Manual :: 13.2.10 UPDATE Syntax

UPDATE table SET column1 = value, column2 = value2, column3 = value3 WHERE column4 = value4

 

[Liam]

You should learn how to write queries first, also, execute the queries in PHPMyAdmin so you can see if it's working. MySQL :: MySQL 5.0 Reference Manual :: 13.2.10 UPDATE Syntax

UPDATE table SET column1 = value, column2 = value2, column3 = value3 WHERE column4 = value4

You've opened my eyes. THANKS!