Gabriel Meono Gabriel Meono - 1 month ago 10
MySQL Question

PHP & SQL: Function to insert and update tables not working

I have a simple code where tables are created and modified, but the tables are not created to start with, and the following errors are appearing:


Undefined variable: price on line 28

Undefined variable: newbrand on line 28

Undefined variable: newprice on line 28


Line 28:

$conexion-> modify("Mitsubishi",40000000,$price,$newbrand,$newprice);


Complete code:

<?php

class MyDataBase{
private $link;

public function __construct($server,$user,$password,$base){
//Conectar
$this->link = mysql_connect($server,$user,$password);
mysql_select_db($base,$this->link);
}

public function insert($model,$brand,$price){
mysql_query("INSERT INTO autos (model, brand, price) VALUES ($model,'$brand', $price)",$this->link);}

public function modify($model,$brand,$price,$newbrand,$newprice){
mysql_query("UPDATE 'crautos'.'autos' SET 'brand' = '$newbrand',
'price' = '$newprice' WHERE 'autos'.'model' =5 AND 'autos'.'brand' = '$brand' AND 'autos'.'price' ='$price' LIMIT 1" ,$this->link);}

public function __destruct(){
//desconectar
}

}


$conexion = new MyDataBase ('localhost', 'root', '','crcars');
$conexion-> insert(05,"Ford",50000000);
$conexion-> modify("Mitsubishi",40000000,$price,$newbrand,$newprice);
?>

Answer Source

$conexion-> modify("Mitsubishi",40000000,$price,$newbrand,$newprice);

You never set the value of $price, $newbrand, $newprice. And also you're not escaping your data :

public function insert($model,$brand,$price){
    $model = mysql_real_escape_string($model);
    $brand = mysql_real_escape_string($brand);
    $price = (int)$price;
    mysql_query("INSERT INTO autos (model, brand, price) VALUES ('$model','$brand', $price)",$this->link);
}

And same for modify you should escape your datas see : http://php.net/manual/fr/function.mysql-real-escape-string.php