need help in php code

helllo sir

I am creating a lyrics website.This is my categories form code please check update query not working. when i press submit button data is deleting not updating. what is problem in code.
Will really appreciate your help... Many thanks n regards.

_______________________________________ ____________________________
<?php

if(isset($_POST["thisID"])==true){

$targetID=$_POST['id'];
$date=date("Y/n/d");
$id=$_POST['id'];
$category=$_POST['category'];
$subcategory=$_POST['subcategory'];
$date=$_POST['date'];
mysql_connect("localhost","root","");
mysql_select_db("lyrics");

$query= "UPDATE categories SET id='$id', category='$category', subcategory='$subcategory', date='$date' WHERE id='$targetID'"or die(mysql_error());
mysql_query($query);
header("refresh:0;url= 'categories.php'");
exit();
}
?>   

<?php
mysql_connect("localhost","root","");
mysql_select_db("lyrics");
if(isset($_GET['pid'])){
$targetID=$_GET['pid'];
$date=date("Y/n/d");
$query=mysql_query("SELECT * FROM categories WHERE id='$targetID' LIMIT 1");
$pCount=mysql_num_rows($query);
if($pCount>0){
while($row= mysql_fetch_array($query)){
$id=$row["id"];
$category=$row["category"];
$subcategory=$row["subcategory"];
$date=$row["date"];
}
}else{
echo "Sorry ";

}
}
?>   


<form action="editcategories.php" method="post">
<table>
<tr>
<td>Edit Lyrics</td>
</tr>
<tr>
<td>Category-ID</td>
<td><input type="text" name="id" size="2" value="<?php echo $id; ?>"></td>
</tr>
<tr>
<td>Category</td>
<td>
<select name="<?php echo $category; ?>"> <?php echo $category; ?> </option>
<option value="Hindi Movies">Hindi Movies</option>
<option value="Devosional Movies">Devosional Movies</option>
<option value="Pop Songs">Pop Songs</option>
<option value="Reginal Songs">Reginal Songs</option>
<option value="Album Songs">Album Songs</option></select></td></tr>
<tr>
<td>Subcategory</td>
<td>
<select name="<?php echo $subcategory; ?>"><?php echo $subcategory; ?></option>
<option value="Movies Songs">Movies Songs</option>
<option value="Devosional Songs">Devosional Songs</option>
<option value="Pop Songs">Pop Songs</option>
<option value="Reginal Songs">Reginal Songs</option>
<option value="Album Songs">Album Songs</option>
</select>
</td>
</tr>
<tr>
<td ></td>
<td >
<input name="thisID"  type="hidden" value= "<?php echo $pid; ?>"/>
 <input type="submit" name="button" id="button" value="MakeChanges" /></td>
</tr>
</table>
</form>

[Web moderator]

See here for info on updating values: http://www.w3schools.com/php/php_mysql_update.asp

Also, this code is very unsecure and is liable to SQL injection:

Code: [Select]

$targetID=$_POST['id'];
$date=date("Y/n/d");
$id=$_POST['id'];
$category=$_POST['category'];
$subcategory=$_POST['subcategory'];
$date=$_POST['date'];

To solve this, do a strip_tags on all these variables.

strip_tags? more like mysql_real_escape_string()...

or possibly some combination of both.

[Web moderator]

Yeah, I should have said strip_tags to prevent XSS and escape them to prevent SQLI.