Problem with jeditable plugin

Question

Problem with jeditable. Want to change user information on the fly but it doesn't work. during debugging it shows POST ok, no error, no success

My code (index.php)

<script src="http://code.jquery.com/jquery-latest.js"></script>
<script src="js/jquery.jeditable.js"></script>
<script type="text/javascript" charset="utf-8">
$(document).ready(function() {
  $(".dblclick").editable("change.php", { 
    submitdata : {userid: "<?=$id?>"},
     id   : 'elementid',
     name : 'newvalue',
      indicator : "<img src='styles/images/ui-anim_basic_16x16.gif'>",
      tooltip   : "click to edit",
      event     : "dblclick",
      style  : "inherit"
  });
  });
  </script>
...
<div id="fullname" class="dblclick" ><?=$person->fullname?></div>

change.php

<?php
require 'db.php';
$id=$_POST['userid'];
$field=$_POST['elementid'];
$newvalue=$_POST['newvalue'];
if(isset ($id) && isset($field) && isset($newvalue) )
{$query =  $db->query("UPDATE usr_table  SET '$field'='$newvalue' WHERE id = '$id'")  or die(mysqli_errno());
    }
?>

Where am i wrong?

Answer 1

You have to use backticks around column names, not quotes. However, I must note that the way this code is written is extremely insecure. You should never, ever put GET POST variables directly into a database query.

This is better:

<?php
require 'db.php';

function fail($msg) {
    header('HTTP/1.0 404 Not Found');
    die($msg);
}

$id = (int)@$_POST['userid'];
if (!$id) fail('User ID invalid or missing.', 404);

$field = @$_POST['elementid'];
$allowed_fields = array('fullname','dob','phone','adress','school','info');
if (!in_array($field, $allowed_fields)) fail('Invalid or missing field.', 404);

$newvalue = $db->real_escape_string(@$_POST['newvalue']);

$db->query("UPDATE usr_table SET `$field`='$newvalue' WHERE id=$id") or fail($db->error);

$q = $db->query("SELECT `$field` from usr_table where id=$id") or fail($db->error);
if ($r = $q->fetch_row()) echo $r[0];
else fail('User not found.');