PHP - using update with variables

Question

I am using php to update a mysql DB within a function. I am able to echo my variable names and was able to return the variables on the php page. This proves to me that my variables are working correctly.

Now when I use the update command, my DB does not respond. Yes, I have connected to the DB and it all works.

This is what I am using to update:

mysql_query("UPDATE `table_name`
            SET `int_field` = '$int_value'
            WHERE `username` = $username");

After query, you should check the result, from the error, you will find the wrong part easily. For you case, you missed the quotes for $username — xdazz
– xdazz, Commented Sep 30, 2012 at 4:56
Swap the string-delimeters from the int to string perhaps?.. mysql_query("UPDATE table_name SET int_field = $int_value WHERE username = '$username'"); — enhzflep
– enhzflep, Commented Sep 30, 2012 at 4:58

Community · Accepted Answer · 2017-05-23 12:08:52Z

3

The value for $username should be wrap with single quotes.

mysql_query(" UPDATE table_name 
                 SET int_field = '$int_value' 
               WHERE username = '$username'");

SideNote: your code is vulnerable with SQL Injection. Please read the article below to know how to secure your code,

Best way to prevent SQL injection in PHP?

edited May 23, 2017 at 12:08

CommunityBot

11 silver badge

answered Sep 30, 2012 at 4:55

John Woo

265k70 gold badges509 silver badges500 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Slap Shot Over a year ago

Thanks, that had worked using quotes around $username. And thanks for the sql injection link. I am using a sanitize function on all field variables as well.

John Woo Over a year ago

@SlapShot you are welcome :D and Welcome to StackOverFlow Community!

jimp · Accepted Answer · 2012-09-30 05:27:13Z

1

You need to quote all of your input to the query. This prevents SQL injection, but also simple syntax errors that would occur if your user innocently inputs a special character that would break your query.

mysql_query('UPDATE table_name '.
            'SET int_field = "'.mysql_real_escape_string($int_value).'" '.
            'WHERE username = "'.mysql_real_escape_string($username).'"');

answered Sep 30, 2012 at 5:27

jimp

17.6k3 gold badges30 silver badges39 bronze badges

Comments

Yu Hao · Accepted Answer · 2016-01-03 05:58:06Z

1

This is the correct STRUCTURE of how to update with a variable in php

mysql_query("UPDATE tablename SET password='". $NPass ."' WHERE custID='$num'");

edited Jan 3, 2016 at 5:58

Yu Hao

123k50 gold badges252 silver badges305 bronze badges

answered Jan 3, 2016 at 5:29

Kingsley Mitchell

2,5992 gold badges21 silver badges25 bronze badges

Comments

user1607528 · Accepted Answer · 2012-09-30 05:00:15Z

0

Try this :

         mysql_query("UPDATE `table_name`
         SET `int_field` = '$int_value'
        WHERE `username` = '$username'");

answered Sep 30, 2012 at 5:00

user1607528

Comments

ballsDeep · Accepted Answer · 2014-01-28 07:43:48Z

0

I had the same problem and found that the SET value doesn't need single quotes and that the WHERE clause does ...

mysql_query("UPDATE table_name SET int_field=$int_value
WHERE username='$username'");

.. seemed to work for me.

answered Jan 28, 2014 at 7:43

ballsDeep

1

Collectives™ on Stack Overflow

PHP - using update with variables

5 Answers 5

2 Comments

Comments

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

2 Comments

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related