form creates query to update database

[kelme1007]

I'm creating a php page which has the user fill out a form to update a database table. The problem is if the user leaves a field blank (ex: firstName) I need that specific field information in the database remain untouched but update the rest where information was filled in.
Just to clarify: The user can update firstName, lastName, and address. If the user only wants to change their address they would simply leave firstName and lastName blank, and put their new address in the address box. How would I go about making this query dynamic?

Thanks,
Pete

[bazz]

look into UPDATE in the docs.

Presumably, when you display the form, you could also have their record 'id' in the script, though not necessarily shown on the outputted page content).
Then you would update their record:


UPDATE table_name
set address = (the value submitted)
, field_name2 = (any other value submitted)
WHERE id= id


hth

bazz

[kelme1007]

<form action='.$_SERVER['PHP_SELF'].' method="POST">
firstName<input type='text' name='firstName' value='$firstName'>
lastName <input type='text' name='lastName' value='$lastName'>";
address: <input type='text' name='address' value='$address'>";
<input type=submit name=update_movie value=Update Movie Database>
</form>

then i used php to get the data from the form
$firstName=$_POST['firstName'];
$lastName=$_POST['lastName'];
$address=$_POST['address'];

then have the information go into a query
$query="update address set firstName='$firstName', lastName='$lastName', address='$address' where lastName='$lastName'";

so if the user leaves firstName and lastName blank but fills in address, how would the query automatically know to leave the two blank fields untouched in the database but update the address column?

Thanks,
Pete

[rangana]

If values are empty, it will insert empty values too, so no need to worry about that.

Also, it would be best to sanitize your input:

function clean($str) {
return mysql_real_escape_string($str);
}

$query=mysql_query("UPDATE address SET firstName='".clean($firstName)."', lastName='".clean($lastName)."', address='".clean($address)."' WHERE lastName='".clean($lastName)."'");


Check this links for more info:
http://php.net/manual/en/function.mysql-real-escape-string.php
http://www.tizag.com/mysqlTutorial/mysql-php-sql-injection.php
http://en.wikipedia.org/wiki/SQL_injection

[kelme1007]

Thanks for the escape tip. But what if the user leaves a field blank, that blank field will overwrite the information in the database. What I want is if a blank entry is present, that entry will not overwrite the information in the database, but the remaining filled in entries will continue to update the database.

[rangana]

Might work:

$firstName=clean($_POST['firstName']);
$lastName=clean($_POST['lastName']);
$address=clean($_POST['address']);

$updateStr = 'UPDATE address SET ';
if ($firstName != '')
$updateStr .= "firstName = '$firstname', ";
if ($lastName != '')
$updateStr .= "lastName = '$lastName', ";
if ($address !='')
$updateStr .= "address = '$address', ";


$query = mysql_query($updateStr) or die('Something went wrong: '.mysql_error());

[kelme1007]

The if statements worked. I did not know you could add to the query like that. Thanks for the help.

Thanks,
Pete