0

I'm trying to build an update query but I keep getting the following error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '='Damien', last_name='Surname', where id='49'' at line 2

My PHP is as follows:

if($get['cmd'] == 'sname')
{
mysql_query("update users 
`first_name`='$get[first_name]', 
`last_name`='$get[last_name]',
where `id`='$get[id]'") or die(mysql_error());
//header("Location: $ret"); 
echo "changes done";
exit();
}

and HTML as follows

<input name="doSave" type="button" id="doSave" value="Save" onclick='$.get("dos.php",{ cmd: "sname",first_name:$("input#first_name").val(),last_name:$("input#last_name").val(),id: "<?php echo $row_settings['id']; ?>" } ,function(data){ $("#msg").html(data); });'>

Can anyone see what's wrong in my code that will be giving me this error?

3
  • 5
    Nice SQL injection holes... enjoy having your server pw3nd. Commented May 6, 2012 at 2:30
  • @Marc B - How does that comment help me? Commented May 6, 2012 at 2:47
  • Would you mind giving me an idea of stopping this then? Do note this is just my demo database and will be completely changed when I go live? Thanks for that link @Siva Commented May 6, 2012 at 2:53

2 Answers 2

4

If i am not wrong SET keyword is required and the extra comma is to be removed..correct me if I am wrong...

if($get['cmd'] == 'sname')
{
    mysql_query("update users SET 
    first_name ='$get[first_name]', 
    last_name ='$get[last_name]'
    where id ='$get[id]'") or die(mysql_error());
    //header("Location: $ret"); 
    echo "changes done";
    exit();
 } 
Sign up to request clarification or add additional context in comments.

Comments

2

You have a comma after the below statement that is not required.

`last_name`='$get[last_name]',

It should be as stated below. Note that the comma has been removed from the end of this line.

`last_name`='$get[last_name]'

1 Comment

Of course. I didn't even think of that. :). Thanks heaps. Goes with answer comment

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.