Basic wpdb update question

Question

I can't get this to work and I don't really know how to debug it. In the URL I'm getting this added: ?candidat=41&selectCandidate=selectCandidate

global $wpdb;


    if(isset($_POST['selectCandidate']))
    {
        global $wpdb;
        $selected_candidate = $_POST['candidat'];  // Storing Selected Value In Variable
          $wpdb->query( $wpdb->prepare("UPDATE pp_candidates 
            SET candidate_approved = 1  WHERE candidate_ID = '".$selected_candidate."' "));
          $wpdb->show_errors();

    }

    if (!isset($_POST['candidatebutton'])) 
        {echo '<div class="projectcandidatelist"></div>';
        }
    else
    {
    echo '<div class="projectcandidatelist"><form action="" id="candidat_list">';

    $project_candidat = $wpdb->get_results("SELECT *  FROM pp_candidates WHERE project_ID ='".$_POST['candidatebutton']."' ");

    foreach($project_candidat as $candidat)
        {
        echo    '<p><input type="radio" name="candidat" value="'.$candidat->candidate_ID.'" >
        <a href="'.$candidat->candidate_url.'">'.$candidat->candidate_displayname.'</a></p>';
        }
        echo '<input type="submit" value="selectCandidate" name="selectCandidate">';

        echo '</form></div>';   
    }

I would like the column (tinyint) 'candidate_approved' to go to 1. Thanks in advance.

Answer 1

I think the line should be:

$selected_candidate = $_POST['candidat']; 
=> 
$selected_candidate = $_POST['selectCandidate']

Btw. You are using "prepare" in the wrong way. You are not protecting yourself from sql injections, use it like this:

$wpdb->query( $wpdb->prepare("UPDATE pp_candidates SET candidate_approved = 1  WHERE candidate_ID = %d", $selected_candidate));