update row with array items into database php

Question

I am trying to update a record in my database with values pulled from an exploded array

    $arr2 = explode(",",$_POST['hidden-tags']); 
   //echo $arr2[0];

   //insert new rows into blog post
    mysql_select_db($db, $db);
 $insertq = mysql_query("UPDATE blog SET tags1 = $arr2[0],tags2 = $arr2[1],tags3 = $arr2[2], tags4 = $arr2[3], tags5 = $arr2[4]  WHERE idblog = '$id' ",$dbconnet);

If I echo the values from my array one at a time it works great. Once I try to put them in the db the row turns up empty. Whats more the user may not of entered 5 items they may only have entered 1 but I dont think thats really the problem. To be honest I cant see why its currently failing at all.

I know I can save all values in one field but it will be easier as separate fieldsfor when I pull back and query later on.

Community · Accepted Answer · 2017-05-23 10:24:50Z

1

if the data types of the columns are string, values must be wrap with single quotes as they are string literals. eg,

$insertq = mysql_query("UPDATE blog SET tags1 = '". $arr2[0] . "',....");

As a sidenote, the query is vulnerable with SQL Injection if the value(s) of the variables came from the outside. Please take a look at the article below to learn how to prevent from it. By using PreparedStatements you can get rid of using single quotes around values.

How to prevent SQL injection in PHP?

edited May 23, 2017 at 10:24

CommunityBot

11 silver badge

answered Feb 6, 2013 at 11:17

John Woo

265k70 gold badges509 silver badges500 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Daniel Robinson Over a year ago

Thank you for your answer. Data has already been sanitised by this point which is why there is no sql injection protection. Your answer solved my issue. Cant believe I overlooked '".."' as thats something I already knew. Time for a break maybe

Daniel Robinson Over a year ago

Im using dreamweaver built in functions so GetvalueString($VALUE, "text")

nowhere · Accepted Answer · 2013-02-06 11:16:11Z

1

$insertq = mysql_query("UPDATE blog SET tags1 = $arr2[0],tags2 = $arr2[1],tags3 = $arr2[2], tags4 = $arr2[3], tags5 = $arr2[4]  WHERE idblog = '$id' ",$dbconnet);

should be:

$insertq = mysql_query("UPDATE blog SET tags1 = '".$arr2[0]."',tags2 = '".$arr2[1]."',tags3 = '".$arr2[2]."', tags4 = '".$arr2[3]."', tags5 = '".$arr2[4]."'  WHERE idblog = '".$id."' ,$dbconnet);

or the whole query is going to consider the variables names as part of the string

EDITED: i had the quotes inverted.

answered Feb 6, 2013 at 11:16

nowhere

1,5481 gold badge12 silver badges31 bronze badges

Comments

Devang Rathod · Accepted Answer · 2013-02-06 11:18:57Z

1

It should be like this :

$insertq = mysql_query("UPDATE blog SET tags1 = "'.$arr2[0].'",tags2 = "'.$arr2[1].'",tags3 = "'.$arr2[2].'", tags4 = "'.$arr2[3].'", tags5 = "'.$arr2[4].'"  WHERE idblog = "'.$id.'" ",$dbconnet);

answered Feb 6, 2013 at 11:18

Devang Rathod

6,7342 gold badges25 silver badges32 bronze badges

Comments

Roger · Accepted Answer · 2013-02-06 11:19:49Z

1

I think you might need to look at the datatypes of your table. If you are using varchar or text as data-types then single colon will be necessary.

$insertq = mysql_query("UPDATE blog SET tags1 =' $arr2[0]',tags2 = '$arr2[1]',tags3 = '$arr2[2]', tags4 = '$arr2[3]', tags5 = '$arr2[4]'  WHERE idblog = '$id' ",$dbconnet);

Also if the idblog is integer then donot use single quotes.

hope this helps

answered Feb 6, 2013 at 11:19

Roger

1,7011 gold badge18 silver badges34 bronze badges

Collectives™ on Stack Overflow

update row with array items into database php

4 Answers 4

2 Comments

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

2 Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related