Adding or subracting from quantity in a table

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • oriola1
    New Member
    • Mar 2014
    • 20

    Adding or subracting from quantity in a table

    hello guys

    Am trying to write a simple inventory system in php bt am having problem with adding or subracting from a particular product quantity in the databse,
    The update code i wrote is not working infact when i submit from the add and subract form it wil not even give me any error to tackle and when i check my database it has not change..
    plz any that know what am doing wrong shuld help me
    Thanks
    ,,,,,,This is the Add and subract form code

    Code:
    <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
    <html xmlns="http://www.w3.org/1999/xhtml">
    <head>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
    <title>Untitled Document</title>
    </head>
    <h1> ADDITION AND SUBRACTION</h1>
    <body>
         <table>
                <form name="nestle" method="post" action="mod_code.php"/>
                      <tr>
                          <td>
                          <label>NAME</label>&nbsp;<th colspan="col"><input name="name" type="text"/></th>
                          </td>
                       </tr>
                       <tr>
                           <td>
                           <label>AUTH CODE</label>&nbsp;<th colspan="col"><input name="auth_code" type="text"/></th>
                           </td>
                        </tr>
                         <tr>
                           <td>
                           <label>PRODUCT NAME</label>&nbsp;<th colspan="col"><input name="prod_name" type="text"/></th>
                           </td>
                        </tr>
                        <tr>
                        <td>
                        <label>NUMBER</label>&nbsp;<th colspan="col"><input name="number" type="text"/></th>
                        </td>
                      </tr>
                      <tr>
                         <td>
                         <input name="add" type="submit" value="ADD"/>
                         
                      
                     
                         
                          <input name="subract" type="submit" value="SUBRACT"/>
                          </td>
                      </tr>
                  
                  </form>
                </table> 
                
             
                          
                     
                      
                        
    </body>
    </html>
    
    ,,,This is the update code 
    
    <?php
    
    
    require_once("db_connect.php");
    $db=mysqli_connect("$host","$user","$password","$db");
    
    $prod_name=$_POST['prod_name'];
    
    
    if(isset($_post['add'])){
    	$add = $_POST['number'];
    	$query= "update products SET prod_qty = prod_qty + $add WHERE prod_name = $prod_name";
    	$result=mysqli_query($db,$query);
    	if(!@result)
    {
    	die('<p>Error Retrieving</br>');
    }
    
    	
    }
    
    
    if(isset($_POST['subract'])){
    	$subract = $_POST['number'];
    	$query = "update products SET prod_qty = prod_qty - $subract WHERE prod_name= $prod_name";
    	$result=mysqli_query($db,$query);
    	if(!@result)
    {
    	die('<p>Error Retrieving</br>');
    }
    
    }
    
    
    
    
    ?>
    Last edited by Rabbit; Apr 23 '14, 03:58 PM. Reason: Please use [code] and [/code] tags when posting code or formatted data.
  • Dormilich
    Recognized Expert Expert
    • Aug 2008
    • 8694

    #2
    what are lines #68 and #81 supposed to do?

    Comment

    • oriola1
      New Member
      • Mar 2014
      • 20

      #3
      they are to check if there is error in the query then give the eror.. but it was to b $result the variable i use to query the database not result.thanks
      plz any help or wht did u think is wrong with the code

      Comment

      • Dormilich
        Recognized Expert Expert
        • Aug 2008
        • 8694

        #4
        so what do your query functions return?

        Comment

        • oriola1
          New Member
          • Mar 2014
          • 20

          #5
          Thanks alot for ur replies. the query is to query the database and make the update change bt it not doing anytin at and all i get is jst a blank page no message of error or whtso ever..

          Comment

          • Dormilich
            Recognized Expert Expert
            • Aug 2008
            • 8694

            #6
            the update code does not have any output, so why should it display something?

            Comment

            • oriola1
              New Member
              • Mar 2014
              • 20

              #7
              viel dank Domilich
              ok i understand wht u saying if the update code doesnt have any output bt it nt updating the value in the database now.
              i now even added some code to the updating code to give me message if it update the datebase and also give me anoda message if failed bt notin happen stil.
              dis is code now,,
              Code:
              <?php
              
              
              require_once("db_connect.php");
              $db=mysqli_connect("$host","$user","$password","$db");
              
              
              $prod_name=$_POST['prod_name'];
              
              
              if(isset($_post['add'])){
              	$add = $_POST['number'];
              	$query= "update products SET prod_qty = prod_qty + $add WHERE prod_name = $prod_name";
              	$result=mysqli_query($db,$query);
              	if(!@$result)
              {
              	echo"quantity not updated".mysqli_error($nitel);
              }
              else{
              	echo" $prod_name has been updated";
              }
              
              	
              }
              
              
              if(isset($_POST['subract'])){
              	$subract = $_POST['number'];
              	$query = "update products SET prod_qty = prod_qty - $subract WHERE prod_name= $prod_name";
              	$result=mysqli_query($db,$query);
              	if(!@$result)
              {
              	echo"quantity not updatea".mysqli_error($nitel);
              }
              else{
              	echo"$prod_name has been updated";
              }
              
              }
              
              
              
              
              ?>
              Last edited by Rabbit; Apr 27 '14, 05:43 PM. Reason: Please use [code] and [/code] tags when posting code or formatted data. Second warning.

              Comment

              • Dormilich
                Recognized Expert Expert
                • Aug 2008
                • 8694

                #8
                mysqli_error() expects the mysqli instance (connection) to be given, not some arbitrary variable.

                Comment

                • oriola1
                  New Member
                  • Mar 2014
                  • 20

                  #9
                  Thanks man
                  ok, At dis point jst help me go thruogh the code and tel me wht am doing wrong dat is making it not working..

                  Comment

                  • koharu
                    New Member
                    • Apr 2014
                    • 10

                    #10
                    Hi Oriola1

                    I noticed that your script is very susceptible to SQL injections. There are two options for you, you can look at using the string prepare function native to MySQLi. (See: http://php.net/manual/en/mysqli.prepare.php) as best practices are to never use the string directly within the query. I have hardened your code, and fixed some notable errors I saw. Bare in mind that you need to specify the mysqli link for mysqli_error to work. Your link is stored within $db, thus you need to use mysqli_error($d b).

                    Code:
                    <?php
                     
                    require_once("db_connect.php");
                    $db = mysqli_connect($host,$user,$password,$db);
                    if (mysqli_connect_errno()) {
                        printf("Connect failed: %s\n", mysqli_connect_error()); //Verify that we connected.
                        exit();
                    }
                     
                    //Try not to use direct user input, if you do, ensure you validate the data.
                    ((empty($_POST['prod_name'])) ? die('Product Name is required.') : null); //Verify that $_POST['prod_name'] is not empty.
                    
                    $prod_name=add_slashes(preg_replace("/[^a-zA-Z0-9\'\"\.\&\s]/","",$_POST['prod_name'])); //Only allow alpha numeric with ' " & and . punctuation. This adds resistance to MySQL Injection Attacks (" or 1=1 -- would be output as \" or 11 which doesn't really alter the query as the " or ' are escaped for MySQL)
                     
                     
                    if(isset($_post['add'])){
                        $add = $_POST['number'];
                    
                        if(!is_numeric((int)$add)){ //This locks the $_POST['number] to being a whole integer (ie 1 2 3 10 so on.)
                    		exit("Sorry, the amount to add must be a valid number.");
                        }
                    
                        $query = "update products SET prod_qty = prod_qty + $add WHERE prod_name = $prod_name";
                        $result = mysqli_query($db,$query);
                    
                        if(!$result)
                    	{
                        	exit("quantity not updated ".mysqli_error($db)); //Need to use $db here.
                    	}else{
                        	echo "$prod_name has been updated";
                    	}
                    }
                     
                     
                    if(isset($_POST['subract'])){
                        $subract = $_POST['number'];
                    
                    	if(!is_numeric((int)$subtract)){ //This locks the $_POST['number] to being a whole integer (ie 1 2 3 10 so on.)
                    		exit("Sorry, the amount to subtract must be a valid number.");
                    	}
                    	
                    	$query = "update products SET prod_qty = prod_qty - $subract WHERE prod_name= $prod_name";
                    	
                    	$result = mysqli_query($db,$query);
                    
                        if(!$result) //If it is false.
                        {
                    			exit("quantity not updated ".mysqli_error($db));
                    	}else{
                    			echo "$prod_name has been updated";
                    	}
                     
                    }
                    ?>
                    I apologise, I haven't tested this, I've typed it in my head, run the above code through your apache / server to check for any syntax errors, the above code should work from the box.

                    Comment

                    • oriola1
                      New Member
                      • Mar 2014
                      • 20

                      #11
                      Thanks so much i wil try dis now n get back to u.
                      Viel dank Dormilich

                      Comment

                      • oriola1
                        New Member
                        • Mar 2014
                        • 20

                        #12
                        I jst tried the code u ajusted for me infact i copy and paste not to make any silly error bt dis is wht i got..
                        Parse error: syntax error, unexpected '3.' (T_DNUMBER) in C:\xampp\htdocs \nestle\update_ script.php on line 5
                        Thanks

                        Comment

                        • koharu
                          New Member
                          • Apr 2014
                          • 10

                          #13
                          I cut and pasted that script onto a blank server running PHP, MySQL and Apache. It worked perfectly. Verify the code you have in your own files.
                          One can be forgiven to assume that there was some form of copy and paste issue (PEBKAC?) based on "3." causing the error.

                          Can you paste up the contents of your update_script.p hp file?

                          Comment

                          • oriola1
                            New Member
                            • Mar 2014
                            • 20

                            #14
                            Woow... i wil check my code vey wel
                            Thanks

                            Comment

                            • oriola1
                              New Member
                              • Mar 2014
                              • 20

                              #15
                              Hi koharu
                              i hv check n checked bt am getin dis error
                              Parse error: syntax error, unexpected '3.' (T_DNUMBER) in C:\xampp\htdocs \nestle\update_ script.php on line 5
                              plz do u hv an idea of d meaning so i can even knw wht am doing wrong. i knw dat unexpected seem to b somtin is missing bt d '3' makes d error look difficult.
                              tanz

                              Comment

                              Working...