when deleting data you don’t need any kind of view but you do when you want to edit any data so you really want to go to an edit page when updating a record also don’t pass raw data to your db secure the data first, use mysql_real_escape_string http://php.net/manual/en/function.mysql-real-escape-string.php
I’ll give you an example of creating an edit facility.
First you may have a list of records that you want to be able to update something like:
[php]
$q = mysql_query(“SELECT * FROM table”);
while($r = mysql_fetch_object($q)){
echo “
$r->title Edit
”
}
[/php]
this will show the title and create an edit link next to the title in the link I have edit.php? then id=$r->id
the ?id will become a variable on edit.php its a way to pass the id to the edit page.
To get the id on edit.php:
[php]$id = mysql_real_escape_string($_GET[‘id’]);[/php]
then pull the record from the db
[php]
$sql = mysql_query(“SELECT * FROM table WHERE id=’$id’”)or die(mysql_error());
$r = mysql_fetch_object($sql);
[/php]
next write a form i’ve set the action to be empty so when the form is submitted it will reload the same page so it can be processed using the same file, some people prefer to use a separate file for processing.
[php]
Title
[/php]
I’ve included an inout with a type of hidden so you won’t see this but its there its purpose is to hold the id of the record which you need when updating the record the name of the inout field will become a variable when the form is submitted and its data comes from the value attribute.
To process to form check if the form has been submitted then collect the form data then do the update
[php]
//check if form has been submitted
if(isset($_POST[‘submit’)){
//secure form data and add to vars
$id = mysql_real_escape_string($_POST['id']);
$title = mysql_real_escape_string($_POST['title']);
//update db
mysql_query("UPDATE table SET title='$title' WHERE id='$id'")or die(mysql_error());
//inform success
echo '<h1>Updated!</h1>';
}
[/php]
To put it all together: edit.php
[php]
//connect to database first
//check if form has been submitted
if(isset($_POST[‘submit’)){
//secure form data and add to vars
$id = mysql_real_escape_string($_POST['id']);
$title = mysql_real_escape_string($_POST['title']);
//update db
mysql_query("UPDATE table SET title='$title' WHERE id='$id'")or die(mysql_error());
//inform success
echo '<h1>Updated!</h1>';
}
//get the id then pull that record from the db
$id = mysql_real_escape_string($_GET[‘id’]);
$sql = mysql_query(“SELECT * FROM table WHERE id=’$id’”)or die(mysql_error());
$r = mysql_fetch_object($sql);
//now show a form
?>
Title
[/php]
