Update query and web forms

[mondeoman]

I have a page on my web site where the user can update members details. The SQL I am using is this:

mysql_query("UPDATE tblMembers SET FirstName='$field2',Surname='$field3',Role='$field4',Address1='$field5',Address2='$field6',Address3='$field7',Address4='$field8',PostCode='$field9',Telephone='$field10',email='$field11' WHERE eventid ='$id'");

The form Code is:

<form id="form1" name="form1" method="post" action="">

<table width="49%" border="0" align="center">

<td width="35%"></td>

<tr>

<td>Member No</td>
<td><input name="member_id" type="text" id="member_id" /></td>
</tr>
<tr>
<td>First Name</td>

<td><input name="FirstName" type="text" id="FirstName" /></td>
</tr>
<tr>
<td>Surname</td>

<td><input name="Surname" type="text" id="Surname" /></td>
<tr>
<td>Role</td>

<td><input name="Role" type="text" id="Role" /></td>
<tr>
<td>Address</td>

<td><input name="Address1" type="text" id="Address1" /></td>
</tr>
<td></td>
<td><input name="Address2" type="text" id="Address2" /></td>
</tr>
<td></td>
<td><input name="Address3" type="text" id="Address3" /></td>
</tr>
<td></td>
<td><input name="Address4" type="text" id="Address4" /></td>
</tr>
<td>Post Code</td>

<td><input name="PostCode" type="text" id="PostCode" /></td>
</tr>
<td>Telephone</td>

<td><input name="Telephone" type="text" id="Telephone" /></td>
</tr>
<td>email</td>

<td><input name="email" type="text" id="email" /></td>
</tr>
</tr>
</tr>
<tr>
<td>&nbsp;</td>
<td><input type="submit" name="Submit" value="Submit" /></td>
</tr>
</table>
</form></p></td> </tr></table></td> </tr></table></td> </tr></table>

This works but the user has to replace all fields if amendments need to be made. What I want is that the user needs only to update a specific field ratehr than all of them. Is there a way I can achieve this.

I have provided a link to a text file that has all the page's code.

 

[feherke]

Hi

First, your database is vulnerable to SQL injection attacks.

Second, your web page is vulnerable to code injection attacks.

Anyway, your question is not really MySQL related, as neither the problem nor the solution is MySQL. It belongs to forum434. Further more, the above mentioned vulnerabilities can also be cured only in PHP.

Regarding your problem, why not do it the other way :
[ul]
[li]populate all form fields with the current values[/li]
[li]the user changes what has to be changed and leaves all others unchanged[/li]
[li]you just save all form fields[/li]
[/ul]


Feherke.

http://free.rootshell.be/~feherke/