How to pass arguments to mySQL query with php

Question

I am trying to create a dynamic page to soft-delete record from various tables.

Can anyone help me to fix the following statement? I am so confused to the quotes when it comes to variables:

$table_name = $_REQUEST['t'];
$record_id = $_POST['rid'];
$field_id = print_var_name($rid);

$sql="UPDATE `$table_name` SET `is_delete` = 1 WHERE `$field_id` = '$record_id'";

i can't see any syntax error in the sql. all I know is it is vulnerable with sql injection. — John Woo
– John Woo, Commented Jun 25, 2013 at 6:42
Thanks JW. I am just a beginner. These codes are only for password protected admin panel. I will learn hard to avoid sql injection through PDO but that's too advanced for me at this time. :( — Michael Eugene Yuen
– Michael Eugene Yuen, Commented Jun 25, 2013 at 7:52

ST3 · Accepted Answer · 2013-06-25 06:44:46Z

1

I would do it in this way.

$sql="UPDATE `" . $table_name . "` SET `is_delete` = 1 WHERE `" . $field_id . "` = '$record_id'";

answered Jun 25, 2013 at 6:44

ST3

8,9805 gold badges72 silver badges98 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

EHS · Accepted Answer · 2013-06-25 06:51:04Z

1

try this.

 $table_name = $_REQUEST['t'];
    $record_id = $_POST['rid'];
    $field_id = print_var_name($rid);

    $sql="UPDATE ".$table_name." SET ". is_delete." = 1 WHERE " .$field_id. " =" .$record_id;

Or change your query like this.

  $sql="DELETE FROM ".$table_name." WHERE ".$field_id. "=".$record_id;

edited Jun 25, 2013 at 6:51

answered Jun 25, 2013 at 6:45

EHS

2511 gold badge2 silver badges11 bronze badges

1 Comment

John Woo Over a year ago

the OP wants soft delete.

Collectives™ on Stack Overflow

How to pass arguments to mySQL query with php

2 Answers 2

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related