Untitled

<?php

/*

EDIT.PHP

Allows user to edit specific entry in database

*/


// creates the edit record form

// since this form is used multiple times in this file, I have made it a function that is easily reusable

function renderForm($user_id, $user_email, $content, $error)

{

?>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">

<html>

<head>

<title>Edit Record</title>

</head>

<body>

<?php

// if there are any errors, display them

if ($error != '')

{

echo '<div style="padding:4px; border:1px solid red; color:red;">'.$error.'</div>';

}

?>


<form action="" method="post">

<input type="hidden" name="user_id" value="<?php echo $user_id; ?>"/>

<div>

<p><strong>user_id:</strong> <?php echo $user_id; ?></p>

<input type="submit" name="submit" value="Editar">

<strong>email: *</strong> <input type="text" name="user_email" value="<?php echo $user_email; ?>"/><br/>

<strong>contra cheque: *</strong> <textarea rows="20" cols="50" type="text" name="content" value="<?php echo $content; ?>"/><br/>

<p>* Required</p>

<input type="submit" name="submit" value="Editar">

</div>

</form>

</body>

</html>

<?php

}


// connect to the database

include('connect-db.php');


// check if the form has been submitted. If it has, process the form and save it to the database

if (isset($_POST['submit']))

{

// confirm that the 'user_id' value is a valid integer before getting the form data

if (is_numeric($_POST['user_id']))

{

// get form data, making sure it is valid

$user_id = $_POST['user_id'];

$user_email = mysql_real_escape_string(htmlspecialchars($_POST['user_email']));

$content = mysql_real_escape_string(htmlspecialchars($_POST['content']));


// check that firstname/lastname fields are both filled in

if ($user_email == '' || $content == '')

{

// generate error message

$error = 'ERROR: Please fill in all required fields!';


//error, display form

renderForm($user_id, $user_email, $content, $error);

}

else

{

// save the data to the database

mysql_query("UPDATE tbl_users SET user_email='$user_email', content='$content' WHERE user_id='$user_id'")

or die(mysql_error());


// once saved, redirect back to the view page

header("Location: view.php");

}

}

else

{

// if the 'user_id' isn't valid, display an error

echo 'Error!';

}

}

else

// if the form hasn't been submitted, get the data from the db and display the form

{


// get the 'user_id' value from the URL (if it exists), making sure that it is valid (checing that it is numeric/larger than 0)

if (isset($_GET['user_id']) && is_numeric($_GET['user_id']) && $_GET['user_id'] > 0)

{

// query db

$user_id = $_GET['user_id'];

$result = mysql_query("SELECT * FROM tbl_users WHERE user_id=$user_id")

or die(mysql_error());

$row = mysql_fetch_array($result);


// check that the 'user_id' matches up with a row in the databse

if($row)

{


// get data from db

$user_email = $row['user_email'];

$content = $row['content'];


// show form

renderForm($user_id, $user_email, $content, '');

}

else

// if no match, display result

{

echo "No results!";

}

}

else

// if the 'user_id' in the URL isn't valid, or if there is no 'user_id' value, display an error

{

echo 'Error!';

}

}

?>