PHP mySQL query for updating row in table using variables

Question

My PHP file contains the following function. It works when I set the review column to '$review' and the IdUser to 2. But I need to have the IdUser set to the variable $user. What is the correct syntax to set IdUser to the variable instead of a constant? (preferably in a way that avoids SQL injection attacks).

function addRatings2($review, $user) {  
    //try to insert a new row in the "ratings" table with the given UserID
    $result = query("UPDATE ratings SET review ='$review' WHERE IdUser = 2 order by dateTime desc limit 1");    
}

Is $user a string or an integer variable? Strings must be single-quoted just as you have '$review' and escaped via the proper method for whatever database API you are calling with query() (for example mysql_real_escape_string()). — Michael Berkowski
– Michael Berkowski, Commented May 23, 2013 at 3:00

naveen goyal · Accepted Answer · 2014-09-17 11:33:03Z

1

Hi the right syntax is to use

{$var} wherever you want the current value of var to appear, so in your case it would be

$result = query("UPDATE ratings SET review ='{$review}' WHERE IdUser = {$user}
order by dateTime desc limit 1");

edited Sep 17, 2014 at 11:33

naveen goyal

4,6272 gold badges18 silver badges26 bronze badges

answered May 23, 2013 at 3:02

Manuel Alejandro Mijangos Gonz

714 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Manuel Alejandro Mijangos Gonz Over a year ago

oh and to avoid the SQL injection you must use the stripslashes and mysql_real_escape_string functions

Cybernetic Over a year ago

The {$var} isnt working. However if I use single quotes '$var' it works for the review variable but not for the user variable (UserId='$user')

Cybernetic Over a year ago

ooops nevermind I wasnt passing the userID as session in my PHP. Your syntax os exactly correct!!!

Manuel Alejandro Mijangos Gonz Over a year ago

It should but the other way would be to concatenate the var to the string like this $result = query("UPDATE ratings SET review ='$review' WHERE IdUser = " . $user . " order by dateTime desc limit 1"); The dot (.) character is the concatenation operator in php

Tim Matz · Accepted Answer · 2013-05-23 03:09:13Z

1

//anti-injection

$user = (int)$user;

$review = mysql_real_escape_string($result); //mysqli_real_escape_string will be better

$result = query("UPDATE ratings SET review ='$review' WHERE IdUser = $user order by dateTime desc limit 1");

answered May 23, 2013 at 3:09

Tim Matz

514 bronze badges

Comments

BenMorel · Accepted Answer · 2014-06-16 11:19:13Z

1

You must use single quotes for a string as you have done, but you don't need to for an integer

query("UPDATE ratings SET review ='$review' WHERE IdUser = $user order by dateTime desc limit 1");

edited Jun 16, 2014 at 11:19

BenMorel

37k52 gold badges208 silver badges339 bronze badges

answered May 23, 2013 at 3:12

Becs Carter

1,2501 gold badge12 silver badges27 bronze badges

Comments

shark · Accepted Answer · 2013-05-23 03:29:54Z

0

Try this one. function addRatings2($review, $user) {



$review = mysql_real_escape_string($review);

$user = (int)$user 

$result = query("UPDATE ratings SET review ='$review' WHERE IdUser = $user order by        dateTime desc limit 1");

}

answered May 23, 2013 at 3:29

shark

3251 silver badge10 bronze badges

Collectives™ on Stack Overflow

PHP mySQL query for updating row in table using variables

4 Answers 4

4 Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

4 Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related