Mysql Poop

[atholon]

Freakin`

I cannot seem to get PHP to update a mysql section.

anyone see anything wrong with this query?

PHP Code:

      mysql_query("UPDATE tutorialsteps SET thestep='$step[$number]' WHERE stepnumber='$stepnumber' && tutorialnumber='$tutorialid';") or die ("<br /><br />Mysql Error: ".mysql_error()); 


[Lakie]

Try

PHP Code:

mysql_query("UPDATE tutorialsteps SET thestep='$step[number]' WHERE stepnumber='$stepnumber' AND tutorialnumber='$tutorialid'") or die... 


[atholon]

Still didn`t update the MYSQL table. I dunno why...this is the script...

PHP Code:

<?php 
include ("config.php");

$title=$_REQUEST["title"];
$description=$_REQUEST["description"];
$currentuser=$_REQUEST["username"];

$number="0";
$anothernumber="0";
$date=date("m-j-y"); 


    if ($_REQUEST["category1"] != "other")
    {
    $category1=$_REQUEST["category1"];
    }
    else
    {
    $category1=$_REQUEST["othertext"];
    }

    mysql_query("INSERT INTO `tutorials` (`title`, `description`, `date`, `category1`, `approved`) VALUES ('$title', '$description', '$date', '$category1', 'no');") or die ("<br /><br />Mysql Error: ".mysql_error());
    mysql_query("INSERT INTO `tutoriallinks` (`title`, `description`, `approved`,`date`, `category1`,`user`) VALUES ('$title', '$description', 'no','$date', '$category1', '$currentuser');") or die ("<br /><br />Mysql Error: ".mysql_error());
    $tutorialid=mysql_insert_id();


    while ($step[$number])
    {
      $stepnumber=$number+1;
      mysql_query("UPDATE tutorialsteps SET thestep='$step[number]' WHERE stepnumber='$stepnumber' AND tutorialnumber='$tutorialid'") or die ("<br /><br />Mysql Error: ".mysql_error());
      print $step[$number];
      $number++;
    }


      $theid=$tutorialid;
      $number2="0";

  if ($_FILES["ourFiles"]!="")
  {
    foreach ($_FILES["ourFiles"]["error"] as $key => $error) {
      if ($error == UPLOAD_ERR_OK)
      {
       $tmp_name = $_FILES["ourFiles"]["tmp_name"][$key];
       $keynumber=$key + 1;
       $name = $_FILES["ourFiles"]["name"][$key];
       $name=strtolower($_FILES["ourFiles"]["name"][$key]);
       $ext=substr(strrchr($name, "."), 1);
       $name="review"."_".$theid."_".$keynumber."."."$ext";
       mysql_query("INSERT INTO `tutorialfiles` (`tutorialnumber`, `stepnumber`, `thefile`) VALUES ('$tutorialid', '$keynumber', '$name');") or die ("<br /><br />Mysql Error: ".mysql_error());
       move_uploaded_file($tmp_name, "./uploads/$name");
       $iRedirURL="./tutorials.php?view=tutorial&sid=$tutorialid";
      }

    }
  }

    ?>

[Lakie]

do you have msn?

msn[@]mikes[]hq.net remove the []

[Scott]

You really need to think about input validation. That script is vunerable to mysql injection everywhere.

http://www.php.net/mysql_real_escape_string

Also search google for "mysql injection"

[atholon]

Thanks man,
I figured out what was wrong with the bloody script. Oh my gosh. I am a retard!