Chapter 12 update_user.php issues

sgtwwilson · May 7th, 2009, 08:42 PM

I seem to be having a problem with both the code in the book and the downloaded code in Chapter 12. The update_user.php file is performing incorrectly.

When I update user information from the admin screen, all users in the table get updated with the new information... eg. if I change a first name to fred... everyone in the db's first name becomes fred. I assume there is an issue with the query...

here is the code from WROX

// No errors so enter the information into the database.

PHP Code:


			
   if (!empty($password)) {
            $query = 'UPDATE site_user SET
                    password = PASSWORD("' .
                        mysql_real_escape_string($password, $db) . '")
                WHERE
                    user_id = ' . $user_id;
            mysql_query($query, $db) or die(mysql_error());
        }

        $query = 'UPDATE site_user u, site_user_info SET
            username = "' . mysql_real_escape_string($username, $db) . '",
            first_name = "' . mysql_real_escape_string($first_name, $db) . '",
            last_name = "' . mysql_real_escape_string($last_name, $db) . '",
            email = "' . mysql_real_escape_string($email, $db) . '",
            city = "' . mysql_real_escape_string($city, $db) . '",
            state = "' . mysql_real_escape_string($state, $db) . '",
            hobbies = "' . mysql_real_escape_string(join(', ', $hobbies), $db) . '"
          WHERE
            u.user_id = ' . $user_id;
        mysql_query($query, $db) or die(mysql_error());
        mysql_close($db);

anyone know how to fix this?

-K

sgtwwilson · May 7th, 2009, 08:46 PM

I've figured this out...

it looks like there needs to be a join to the site_user_info table or else the entire table gets updated...

Guess this qualifies as errata.

I edited the query to look like this and it works fine now.

PHP Code:


			

(snip)
$query = 'UPDATE 
                    site_user u JOIN site_user_info i ON u.user_id = i.user_id 
                SET
                    username = "' . mysql_real_escape_string($username, $db) . '",
                    first_name = "' . mysql_real_escape_string($first_name, $db) . '",
                    last_name = "' . mysql_real_escape_string($last_name, $db) . '",
                    email = "' . mysql_real_escape_string($email, $db) . '",
                    city = "' . mysql_real_escape_string($city, $db) . '",
                    state = "' . mysql_real_escape_string($state, $db) . '",
                    hobbies = "' . mysql_real_escape_string(join(', ', $hobbies), $db) . '"
                  WHERE
                    u.user_id = ' . $user_id;