Change this
$sql="UPDATE messages SET message = '$details' WHERE id = '?'";
to this
if (($id =~ /^\d+$/) && ($id > 0)) {
$sql="UPDATE messages SET message = '$details' WHERE id = $id";
}
else { die("No id to update"); }
Note
- the removal of quotes - you do not need to quote numeric values. If your id field is varchar or otherwise non numeric, leave them in.
- The if /else does something else very important, makes sure we're querying with a number. There should be more filtering on this to insure it's **this** user, but it's a start (toward cleansing input).
Additionally I'd change this
$sth->execute || print $sql;
to this
$sth->execute || die("Could not update at line 16");
Reason being, displaying an sql statement in a public script could reveal details about your database to potential hackers. It's OK to leave it as is for testing, but these things have a way of never getting updated in final deployment. :-)
Edit: i did use WHERE id = '$id'; but it still does not want to update. How do i put a permission to the table to be able to update?
I didn't see this (must have cross-posted.) If the user doesn't have permissions, you'd likely see the "print $sql" statement (execute OR DO THIS.) Anyway that is set in the mysql command line or wherever you created the database.
For debugging only (note comments above) you can change your execute like so:
$sth->execute || print $db->errstr();
This would display the error returned by mySQL. However, knowing you put ID in I think if you add my error trap, you are more likely to see "No ID to update." This being the case, you'd need to find out why
my $id=$query->param('ID');
is not populating $id - is there a hidden field named ID actually in your form?
