php and MYSQL update?

[jwebhost]

Hello everyone;

I have been not part of this forum before but have been actively viewing over it for a few months. And quite obviously but never signed up.

I now come to you seeking help. I am having some issues with UPDATING a mysql table.

Specifically the message_read column; where it needs to be changed from 0 to 1.

This will indicate that the message will be read and will change the tables <tr> background colour, but I cant seem to get the code to work!

I have posted MOST of the code as you can then see what the problem is and how it is put together.

This is a custom build messaging system, so any help is greatly appreciated.

<?php

//This updates the message status. Retrive data from buttons in form

$Read = $_POST['Make as Read']; 
$Spam = $_POST['Spam']; 
$Remove = $_POST['Remove'];

//ID from tick boxs in Form for each message. ( I think )

$messageid = $POST['id'];

//Update message_Read from 0 to 1 - Updates the message status

if ($Read) 
{ 
$query = mysql_query("UPDATE messages SET message_read = '1' WHERE id = '$messageid'");
exit; 
}

// Message admin with a notifaction displaying to_user, from_user and message_id.

if ($Spam) 
{ 
// Edit Something 
exit; 
}

//Update "messages" in to_user from '$_SESSION[user_id]' to 0; keeping the message in the database but not viewable to the user.

if ($Remove) 
{ 
// Remove Something 
exit; 
} 
?>

  <br />
  Select: (All) <input type="checkbox" onClick="toggle(this)" /></td>
 </tr>
 <tr>
 <td width="53%">
 <form action="<?php echo $_SERVER['php_SELF'];?>" method="post"> 

 <input type=hidden name="Make as Read"> 
<input type="submit" value="Make as Read">

<input type=hidden name="Spam"> 
<input type="submit" value="Spam">

<input type="hidden" name="Remove"> 
<input type="submit" value="Remove">
  <?php
// get the messages from the table.
$get_messages = mysql_query("SELECT message_id FROM messages WHERE to_user='$_SESSION[user_id]' ORDER BY message_id DESC LIMIT 0, 10") or die(mysql_error());
$get_messages2 = mysql_query("SELECT * FROM messages WHERE to_user IN (SELECT id FROM users WHERE id='$_SESSION[user_id]') ORDER BY message_id DESC LIMIT 0, 10") or die(mysql_error());
$num_messages = mysql_num_rows($get_messages);

// display each message title, with a link to their content
echo '<ul>';
for($count = 1; $count <= $num_messages; $count++)
{

$row = mysql_fetch_array($get_messages2);

echo "<table width='100%' border='0' bgcolor='#E4E4E4'>";

 //if the message is not read, show "(new)" after the title, else, just show the title.
echo '<tr>';
echo '<td width="5%" rowspan="3">' . $row['imagelocation'] . '</td>';
echo '<td width="10%">Title: <b></td>';
echo '<td width="85%"><a href="read_message.php?messageid=' . $row['message_id'] . '">' . $row['message_title'] . '</a></b></td>';
echo '</tr>'; 
echo '<tr>';
echo '<td>From: <b></td>';
echo '<td>' . $row['from_user'] . '</b></td>';
echo '</tr>';
echo '<tr>';
echo '<td>Text: <b></td>';
echo '<td>' . $row['message_contents'] . '</b></td>';
echo '</tr>';
echo '<tr><td><input type="checkbox" name="messageTick" id="' . $row['message_id'] . '" /></td><td colspan="2"><div class="date">Sent '.$row['message_date'] .' at '.$row['message_time'] .'</b></div></td></tr>';
}
echo '</table>';
echo '</ul>';
echo '<form action="new_message.php">';
echo '<span class="art-button-wrapper">';
echo '<span class="l"> </span>';
echo '<span class="r"> </span>';
echo '<input class="art-button" type="submit" value="New Message"/>';
echo '</span>';
echo '</form>';
echo '<form action="inbox.php">';
echo '<span class="art-button-wrapper">';
echo '<span class="l"> </span>';
echo '<span class="r"> </span>';
echo '<input class="art-button" type="submit" value="Refresh"/>';
echo '</span>';
echo '</form>';
?>
 </form>

I thank you for your time any assistance you can provide me!

[enigma1]

Hi jwebhost welcome to the forums,

first make sure the form is submitted to the right place.

change:
<form action="<?php echo $_SERVER['php_SELF'];?>" method="post">

to:
<form action="<?php echo basename($_SERVER['SCRIPT_NAME']); ?>" method="post">
so the form is posted to the current script.

Then the $Read variable check has no purpose because in the form you're always setting it up:
<input type=hidden name="Make as Read">
If you want it be conditional, you could use a checkbox instead of a hidden field then you could check it it's ticked:

$Read = isset($_POST['make_as_read'])?true:false;

and the html
<input type="checkbox" name="make_as_read" value="1" />

and avoid using spaces with the html vars.

[Matthew1980]

Hi there jwebhost,

Welcome to WebmasterWorld.

//ID from tick boxs in Form for each message. ( I think )
$messageid = $POST['id'];

Just thought I should mention this to you, as this *should* have stopped your script working, if it hasn't, then please change the top line of your php file to this:-
<?php
error_reporting(E_ALL);

Because you code should read:-

//ID from tick boxs in Form for each message. ( I think )
$messageid = $_POST['id'];

If you have a check box on your form, check that you have the names right by running the submit process though print_r($_POST); on your receiver script..

also @enigma1

<form action="<?php echo basename($_SERVER['SCRIPT_NAME']); ?>" method="post">

Not strictly necessary, the action attribute *shouldn't* use $_SERVER['PHP_SELF'] as there are known security issues with it, either leave it blank (which will fail any validation attempt) or just pop the file name of the script that your working on IF the php processing code and the form are all in the same file, as the default action when the submit button is pressed, is for the form to submit to itself.

Another point:

for($count = 1; $count <= $num_messages; $count++)

you can change this to:-

for($count = 1; $count<$num_messages; $count++)

because the very nature if the for loop and the way you have written it is so that when the middle condition reaches and becomes equal to the second parameter, the loop finishes looping and the parser moves onto the next action.

if ($Read){
$query = mysql_query("UPDATE messages SET message_read = '1' WHERE id = '$messageid'");
exit;
}

For this you could omit the ' single quotes around the concatenated variable, as this (I assume) is a integer? and you don't quote int's (at least this is what I have learnt from Rocknbil recently! Much kudos to you for that too!)

And because you have no specific way of checking the success of this statement (unless this is by design) your not really giving yourself an easy job if you have to handle errors coming back from the server if the sql server was to suffer some down time, IMO you always need to have error handlers in your script, or even pipe these error messages to a file (which I have recently learned the hardway) which can save you a lot of hassle in the longrun.

Lastly, for all sql queries, again, only my opinion, you should always build them up outside the function so that you can check (debug) them to see if they are getting populated as desired. So many times I have had to go through people's code and find out why the database isn't getting the expected results, it can become a bore - thus IMO it is a good piece of coding practise too, I fin it particularly invaluable in VB.Net & other such languages as this can save a lot of time.

Sorry to babble on, but I just thought I should share that with you.

Cheers,
MRb