Hoe zorg ik er voor dat je geen id uit je hoofd kan invoeren en overbodige letters met andere leestekens blokkeren?
Dit helpt bij mij niet:
bindParam(1,is_numeric($_GET['id']))en dit:
is_numeric(bindParam(1,$_GET['id']))Beetje opgeschoond om het kleiner te krijgen:
<?PHP
session_start();
if (!(isset($_SESSION['user_login_status']) && $_SESSION['user_login_status'] != '')) {
header ("Location: index.php");
}
else {
try {
$dbc = new PDO('mysql:host=localhost; dbname=', '', '');
} catch (PDOException $e) {
echo "Error: " . $e->getMessage();
}
if(isset($_POST['submit_btn'])) {
$query = "UPDATE tabel SET name=? WHERE id=?";
$stmt = $dbc->prepare($query);
$stmt->bindParam(1, $_POST['name']);
$stmt->bindParam(2, $_POST['uid']);
if($stmt->execute()) {
echo "<script>alert('Record updated.');location.href='index.php'</script>";
} else {
die('Unable to update record.');
}
} else {
try {
$query = "SELECT * FROM tabel WHERE id=?";
$stmt = $dbc->prepare($query);
$stmt->bindParam(1,$_GET['id']);
$stmt->execute();
$row=$stmt->fetch(PDO::FETCH_ASSOC);
$username = $row['user_name'];
$id = $row['id'];
} catch(PDOException $e) {
echo "Error: " . $e->getMessage();
}
?>
<form id=".$row["id"]." action="" method="POST">
<input type="hidden" value="<?php echo $id; ?>" name="uid">
<div class="container">
<div class="panel-heading">
<h3 class="panel-title">Gegevens</h3>
</div>
<div class="panel-body">
<div class="row">
<div class="col-md-6">
<table class="table">
<tbody>
<tr>
<td>Naam</td>
<td><input class="form-control" type="text" id="formGroupInputSmall" placeholder="Naam"name="username" value="<?php echo $username; ?>"/></td>
</tr>
</tbody>
</table>
<input class="btn btn-default" type="submit" name="submit_btn" value="Bevestigen"/>
</form>
</div>
</div>
</div>
</div>
</body>
<?php
}?>
</html>
<?php
}
?>
