multiple update using ajax with php

Question

hey guys im trying to update my database using php ang ajax, but assuming that the textbox are dynamic thats why im trying to update the database using multiple updates with one click of a button but my fire bug says that "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '= '100' WHERE student_id = '33' AND subject_id = '2' AND school_id = '1' AND adv' at line 1 " im not pretty sure with my code because im just experimenting on how to do it in ajax with php.

PHP:

    session_start();
    $school_id = $_SESSION['school_id'];
    $faculty_id = $_SESSION['user_id_fac'];
    $subject_id = $_POST['subject_id'];
    $year_grade_level = $_POST['year_level'];
    $subject_handeler_id = $_POST['subject_handler_id'];
    $student_grades_boy = $_POST['student_grades_boy'];
    $student_grades_girl = $_POST['student_grades_girl'];

    $update_grades_boys = "UPDATE registrar_grade_archive SET"; 

    //SET status = '0' WHERE subject_id = '$subject_id'"

    $vaues_girl = array();
    $values_boy = array();


    foreach ($student_grades_boy as $key=>$data) {
                                $student_id_B= $data['studnt_B_id'];
                                $grade_B = $data['studnt_grade_B'];

        $values_boy[$key] = 'grade = \''.$grade_B.'\' WHERE student_id = \''.$student_id_B.'\' AND subject_id = \''.$subject_id.'\' AND school_id = \''.$school_id.'\' AND advisor_faculty_id = \''.$faculty_id.'\' AND subject_handler_id = \''.$subject_handeler_id.'\' ' ;

                            }

        $values_boy = implode(', ', $values_boy);

        $ready_edit_grades_boy = $update_grades_boys . $values_boy;

        $save_grades_boy = mysql_query($ready_edit_grades_boy) or die(mysql_error());

please help guys. thanks in advance

are all of your IDs strings? You are wrapping then in single quotes. Integers do not need quotes. In fact all of your numbers are wrapped in quotes. — Leeish
– Leeish, Commented Jan 14, 2013 at 17:40
Please, don't use mysql_* functions in new code. They are no longer maintained and are officially deprecated. See the red box? Learn about prepared statements instead, and use PDO or MySQLi - this article will help you decide which. If you choose PDO, here is a good tutorial. — Kermit
– Kermit, Commented Jan 14, 2013 at 17:41
Echo this query $ready_edit_grades_boy and paste the output here so we can see — Hanky Panky
– Hanky Panky, Commented Jan 14, 2013 at 17:41
They don't need quotes, but mysql won't complain if you quote numbers. — Sam Dufel
– Sam Dufel, Commented Jan 14, 2013 at 17:42
Nice SQL injection holes. Enjoy having your server pwn3d, or at least all students getting A++++++ on their finals — Marc B
– Marc B, Commented Jan 14, 2013 at 17:43

jeroen · Accepted Answer · 2013-01-14 17:44:28Z

2

Some problems here:

if $student_grades_boy contains more than 1 item, your sql will have multiple WHERE statements (you can only have 1);
you need a space between SET and the column name;
you have a serious sql injection problem;
you should switch to PDO or mysqli as the mysql_ functions are deprecated.

answered Jan 14, 2013 at 17:44

jeroen

91.8k22 gold badges117 silver badges132 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Kermit · Accepted Answer · 2013-01-14 17:42:16Z

1

It appears you have no space between SET and grade.

Adding a space here should do the trick:

$update_grades_boys = "UPDATE registrar_grade_archive SET ";

If this doesn't do it, it would help tremendously if you could post the result of echo $ready_edit_grades_boy; and update your question.

answered Jan 14, 2013 at 17:42

Kermit

34.1k13 gold badges89 silver badges121 bronze badges

1 Comment

Aoi Over a year ago

my values are pass via ajax how will i echo it?

Rajat Singhal · Accepted Answer · 2013-01-14 17:42:36Z

1

try

$update_grades_boys = "UPDATE registrar_grade_archive SET ";

One space is needed after SET..

answered Jan 14, 2013 at 17:42

Rajat Singhal

11.3k5 gold badges40 silver badges57 bronze badges

Comments

napolux · Accepted Answer · 2013-01-14 17:41:06Z

0

You are not escaping vars, so it could be some ' or " in your values.

http://php.net/manual/en/mysqli.real-escape-string.php

answered Jan 14, 2013 at 17:41

napolux

16.2k9 gold badges55 silver badges72 bronze badges

Collectives™ on Stack Overflow

multiple update using ajax with php

4 Answers 4

Comments

1 Comment

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related