Why am I getting a MySQL "Request Empty" error?

Question

$id = $_REQUEST['id']; $Section = $_REQUEST['section']; $Subject = $_REQUEST['subject']; $type = $_REQUEST['type']; $Start_date1 = isset($_REQUEST['startTxt'])?($_REQUEST['startTxt']):""; $Venue = isset($_REQUEST['venTxt'])?($_REQUEST['venTxt']):""; $Facilitator = isset($_REQUEST['faciTxt'])?($_REQUEST['faciTxt']):""; $Level = isset($_REQUEST['lvlLst'])?($_REQUEST['lvlLst']):""; $Date1 = $_REQUEST['date1']; if(isset($_REQUEST['EDIT'])) { mysql_query("UPDATE service SET Start_date='$Date1', Venue='$Venue', Facilitator='$Faci' WHERE ServiceID ='$id'"); if (!mysql_query($sql,$con)) { die('Error: ' . mysql_error()); } echo '<script type="text/javascript">'; echo 'alert("Changes have been save!");'; echo 'window.location="Admin_RecSchedMapLst.php";'; echo '</script>'; mysql_close($con); } 

When I click "Save", it returns "Error: the request was empty" - why is this?

Answer 1

You call mysql_query() twice, once with a non-existent $sql parameter:

 mysql_query("UPDATE service SET Start_date='$Date1', Venue='$Venue', Facilitator='$Faci' WHERE ServiceID ='$id'"); if (!mysql_query($sql,$con)) 

it should be:

 if (!mysql_query("UPDATE service SET Start_date='$Date1', Venue='$Venue', Facilitator='$Faci' WHERE ServiceID ='$id'")) 

You also do not avoid input, leaving you open for SQL injection. You should use the bound parameters ideally, or at least run your parameters with mysql_real_escape_string() .

For example:

 $Date1 = mysql_real_escape_string($Date1, $conn); 

Answer 2

Please, for the love of the Internet, do not build your own SQL query. Use PDO .

Answer 3

You do not set the $ sql variable and call mysql_query () twice.