So, I'm very new to this php and mysqli and is still learning bit by bit and right now, I'm hitting the bump on the common problem encountered when trying to update data using prepared statement to avoid SQL injection. I'm not clear on where did I do the mistake but I know my data isn't updated because every time I press on the update button, it will only redirect me back on my edit form page.
So, here is my edit-job-post.php
<form action="editpost.php">
<?php
$sql = "SELECT * FROM job_post WHERE id_jobpost='$_GET[id]'";
$result = $conn->query($sql);
if($result->num_rows > 0) {
while($row = $result->fetch_assoc()) {
?>
<div class ="col-md-12 latest-job">
<div class="form-group">
<label for="jobtitle" type="text" id="jobtitle" >Job Title </label>
<input name="ic_no"type="text" class="form-control input-lg" value="<?php echo $row['jobtitle'] ?>" >
</div>
<div class="form-group">
<label for="description" type="text" id="description" >Description </label>
<textarea id="description" name="description" class="form-control"><?php echo $row['description']; ?></textarea>
</div>
<div class="form-group">
<label for="typeofjob" type="text" id="typeofjob" >Type of Job </label>
<input type="text" class="form-control input-lg" id="typeofjob" value="<?php echo $row['typeofjob']?>">
</div>
<div class="form-group">
<label for="salary" type="text" id="salary" >Salary Offered </label>
<input type="number" class="form-control input-lg" id="salary" name="salary" value="<?php echo $row['salary']?>">
</div>
<div class="form-group">
<label for="qualification" type="text" id="qualification" >Qualification Required </label>
<input type="text" class="form-control input-lg" id="qualification" name="qualification" value="<?php echo $row['qualification']?>">
</div>
<div class="form-group">
<button type="submit" class="btn btn-flat btn-success">Update</button>
</div>
</div>
<?php
}
}
?>
</form>
and here is my editpost.php
<?php
session_start();
if(empty ($_SESSION['id_admin'])){
header("Location:../index.php");
exit();
}
require_once("../db.php");
if (isset($_POST['submit'])) {
$sql = $conn->prepare("UPDATE job_post SET jobtitle=? , description=? , typeofjob=?, salary=?, qualification=? WHERE id_jobpost=?");
$jobtitle = mysqli_real_escape_string($conn, $_POST['jobtitle']);
$description = mysqli_real_escape_string($conn, $_POST['description']);
$typeofjob = mysqli_real_escape_string($conn, $_POST['typeofjob']);
$salary = mysqli_real_escape_string($conn, $_POST['salary']);
$qualification = mysqli_real_escape_string($conn, $_POST['qualification']);
$sql->bind_param("sssssi",$jobtitle, $description, $typeofjob, $salary, $qualification, $_GET["id_jobpost"]);
if($sql->execute()) {
$_SESSION['jobEditSuccess'] = true;
header("Location: dashboard.php");
} else {
echo "ERROR";
}
}
else{
header("Location:create-job-post.php");
exit();
}
?>
I have read several questions posted here that might provide the solutions for me like
and many more. I know my question is a duplicate, but I really need to know the answer since I've been reading and found no solution. Thank you in advance for all the kind help.