CODEWITHSUNDEEP
phpmysqlflashactionscript-3
FoxLift
FoxLift

Reputation: 433

Can't update php database with a flash application

I am having some problem here. I am trying to develop a flash database manager for my company, and I already have the insert and "search" functions working okay. The problem comes up when trying to get the UPDATE working. Ill post both codes here:

PHP (UPDATED)

<?php
//connect to the local MySQL
$connect=mysql_connect("localhost", "****", "****");

//select your database
mysql_select_db("****");

//Variables
$ID=$_POST[IDPost];

$Nome=$_POST[Nome];
$Tipo=$_POST[Tipo];
$Empresa=$_POST[Empresa];
$Morada=$_POST[Morada];
$CodPostal=$_POST[CodPostal];
$Email=$_POST[Email];
$Contacto1=$_POST[Contacto1];
$Contacto2=$_POST[Contacto2];
$DataNascimento=$_POST[DataNascimento];
$Profissao=$_POST[Profissao];
$Notas1=$_POST[Notas1];
$Notas2=$_POST[Notas2];

//query the database
$query="

UPDATE 
    GestaoClientes 
SET 
    Nome = '$Nome',
    Tipo = '$Tipo',
    Empresa = '$Empresa',
    Morada = '$Morada',
    CodPostal = '$CodPostal',
    Email = '$Email',
    Contacto1 = '$Contacto1',
    Contacto2 = '$Contacto2',
    DataNascimento = '$DataNascimento',
    Profissao = '$Profissao',
    Notas1 = '$Notas1',
    Notas2 = '$Notas2'
WHERE 
    ID = '$ID'";

$result=mysql_query($query);

if (!mysql_query($query,$connect))
{
    die('Error: ' . mysql_error());
    echo "Result=NotOk";
}else{
    echo "Result=Ok";
}

mysql_close($connect);
?>

Flash

public function editInfo(MouseEvent):void
        {
            var request:URLRequest = new URLRequest ("link.php");
                request.method = URLRequestMethod.POST; 
                trace("called");

                var variables:URLVariables = new URLVariables(); 

                variables.IDPost = NField.text;

                variables.Nome = NomeField.text;
                variables.Email = NomeField.text;
                variables.Morada = MoradaField.text;
                variables.CodPostal = CodPostalField.text;
                variables.Tipo = TipoField.text;
                variables.Empresa = EmpresaField.text;
                variables.Profissao = ProfissaoField.text
                variables.DataNascimento = DataNascimentoField.text;
                variables.Notas1 = Notas1Field.text;
                variables.Notas2 = Notas2Field.text;

                request.data = variables; 

                var loader:URLLoader = new URLLoader (request); 
                loader.addEventListener(Event.COMPLETE, onComplete); 
                loader.dataFormat = URLLoaderDataFormat.VARIABLES; 
                loader.load(request); 

            function onComplete(e:Event):void 
            {
                trace("ok");
            }

}

When I try going to the php in the browser if just gives me the error:

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''Nome' = '', 'Tipo' = '', 'Empresa' = '', 'Morada' = '', 'CodPostal' = '', 'Emai' at line 4

This although is probably normal, since Im not passing any "POST" variables through the browser.

The flash doesent return any errors when trying this code, so I assume the connection itself is okay, but it doesent do the update either. Is there something wrong with this code? Thanks.

UPDATE: I now changed my code, and it does not show the syntax error, but still doesent update within the flash. Any ideias why? :/ thanks

Upvotes: 0

Views: 803

Answers (3)

Yexo
Yexo

Reputation: 1885

Remove the single quotes around the column names. Backticks (`) are allowed, single quotes (') are not.

I hope you realize that if your code really looks like above you have a massive security hole in your application, as anyone can execute arbitrary sql code.

Upvotes: 1

Wesley van Opdorp
Wesley van Opdorp

Reputation: 14941

I suggest you take a close look at escaping your external input! Inserting variables directly into your query exposes you to injection, which is an enormous security issue. (read this).

the problem you have is that you use single quotes around the field names, this is incorrect.

MySQL uses backticks ( ` ), but I do not recommend using those since they limit portability to other sql applications.

Upvotes: 1

Pekka
Pekka

Reputation: 449425

You need to use backticks instead of single quotes for column names:

`Nome`

this is the reason for the syntax error. It is also possible to use no quotes at all.

Also, your code is vulnerable to SQL injection. Read up on the issue, it's essential for security.

To fix the vulnerability at hand, do the following on every variable:

$Nome = mysql_real_escape_string($_POST["Nome"]);

and then insert the escaped variable:

SET `Nome` = '$Nome',

Upvotes: 3

Related Questions