Update mysql database with php

Question

I want to update my database and this code in working good on another table but here i have an error and i see this message:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE id='588'' at line 4

<?php
$sel_item = "SELECT * FROM `employees` where id=".$_GET['emp_id'];
$done_item = mysql_query($sel_item);
$get_item = mysql_fetch_array($done_item);

if(isset($_POST['edit']) ){
    $upd= "UPDATE `employees` SET 
    `emp_no`='".$_POST['name']."',
    WHERE `id`='".$_POST['id']."";
    $do_upd = mysql_query($upd) or die(mysql_error());
}
?>


<form action="" method="post" enctype="multipart/form-data">

         <table class="append-row" width="100%" border="0" bgcolor="#006699"  height="60px" align="left" 
        style="padding:0 30px;">
          <tr>

           <td><input type="text" name="name" id="name" placeholder="name"  value="<? php echo $get_item['emp_no'];?>"></td>
          <input type="hidden" name="id" id="id"    value="<?php echo $get_item['id'];?>" >

          <td><input type="submit" name="edit" id="edit" value="edite"></td>    

      </tr>

        </table>

     </form>

There's a comma after $_POST['name']."', - you need to remove that. — andrewsi
– andrewsi, Commented May 29, 2013 at 16:54
Your code is vulnerable to SQL injections and is also using a deprecated MySQL library. — j883376
– j883376, Commented May 29, 2013 at 16:56

Dan · Accepted Answer · 2013-05-29 16:55:00Z

3

You are missing the closing single quote after the $_POST['id'] in the UPDATE statement and you also have a comma you don't need before the WHERE condition.

Try:

$upd= "UPDATE `employees` SET `emp_no`='".$_POST['name']."' WHERE `id`='".$_POST['id']."'";

answered May 29, 2013 at 16:55

Dan

2,0933 gold badges22 silver badges31 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Dan Over a year ago

Agreed and good point. User input ($_POST) should always be validated before being used in a query. My answer was just to get the query working.

user2406160 · Accepted Answer · 2013-05-29 16:55:53Z

1

$upd= "UPDATE `employees` SET `emp_no`='".$_POST['name']."', WHERE `id`='".$_POST['id'].""; 
$do_upd = mysql_query($upd) or die(mysql_error());

You've missed an ' it should be...

$upd= "UPDATE `employees` SET `emp_no`='".$_POST['name']."', WHERE `id`='".$_POST['id']."'";

You also don't need the comma before 'WHERE'

answered May 29, 2013 at 16:55

user2406160

5383 silver badges8 bronze badges

Comments

Get Off My Lawn · Accepted Answer · 2013-05-29 17:01:37Z

1

Drop the old school Mysql and use PDO to make things easier on you and your database, but your problem is the comma before the WHERE statement.

$sql = $pdo->prepare("UPDATE employees SET emp_no = ? WHERE id = ?");
$sql->execute(array($_POST['name'], $_POST['id']));

As a personal preference, you should NEVER use a tilde `, to surround your items, if it is so you don't use a keyword, then you probably should rename your column/table/database.

answered May 29, 2013 at 17:01

Get Off My Lawn

36.6k47 gold badges201 silver badges380 bronze badges

Comments

Michael Sole · Accepted Answer · 2013-05-29 17:15:57Z

0

emp_no='".$_POST['name']."',

The comma is breaking your SQL

answered May 29, 2013 at 17:15

Michael Sole

1244 bronze badges

Collectives™ on Stack Overflow

Update mysql database with php

4 Answers 4

1 Comment

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

1 Comment

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related