CODEWITHSUNDEEP
phpmysql
dpDesignz
dpDesignz

Reputation: 1959

Database not updating on "Get" PHP

I have a page a query that will set a table to 0 or 1. Setting to 1 is working, but it will not set back to 0. This is a snippet of the code so far. Can anyone see what's wrong?

page:

<p><? if($_SESSION['user_level'] >= GUARDIAN_LEVEL) { if ($row_settings['profile_list'] == 0) {?> 
                    <a onclick='$.get("dos.php",{ cmd: "sprofile", setp:$("1").val(),id: "<?php echo $row_settings['id']; ?>" } ,function(data){ $("#msgp").html(data); });' href="javascript:void(0);">List</a>
                <?php } else if ($row_settings['profile_list'] == 1) {?>
                    <a onclick='$.get("dos.php",{ cmd: "sprofile", setp:$("0").val(),id: "<?php echo $row_settings['id']; ?>" } ,function(data){ $("#msgp").html(data); });' href="javascript:void(0);">Unlist</a>
                <?php } else {echo "N/A";}} else {echo "N/A";} ?></p>

update code:

if($get['cmd'] == 'sprofile')
{
mysql_query("update users set profile_list='$get[setp]' where id='$get[id]'");
echo "Profile Listing Changed";
//header("Location: $ret");  
// exit();
}

EDIT

Update Code:

if($_GET['cmd'] == 'sprofile')
{
$set = mysql_real_escape_string($_GET['setp']);
$id = mysql_real_escape_string($_GET['id']);
mysql_query("update users set profile_list='" . $set . "' where id='" . $id . "'");
echo "Profile Listing Changed";
//header("Location: $ret");  
// exit();
}

This will set it to 0 and display the right code, but will not set back to 1 for some reason.

Upvotes: 0

Views: 148

Answers (3)

dpDesignz
dpDesignz

Reputation: 1959

setp:$("1").val() needs to be changed to setp: "1" as it's not supposed to pulling the value from anywhere

Also changing $get to $_GET works

Upvotes: 0

mavo
mavo

Reputation: 11

Update code:

  1. Use $_GET instead of $get (1st & 3rd line)

  2. Use this line as 1st line:

    if ($_GET['cmd'] == 'sprofile')

  3. Use this line for your mysql_query in the 3rd line:

    mysql_query("update users set profile_list='" . mysql_real_escape_string($_GET['setp']) . "' where id='" . mysql_real_escape_string($_GET['id']) . "';");

Upvotes: 1

UltraInstinct
UltraInstinct

Reputation: 44444

It is $_GET and not $get.

And please atleast use

$param = mysql_real_escape_string($_GET['your_param_which_goes_to_building_mysql_query']);
$param2 = //similar..
$query = "update users set profile_list='$param1' where id='$param2'"

Or better yet, use prepared statements.

Upvotes: 2

Related Questions