PHP SQL Statement not accepting Variable

Question

I'm trying to use the following code however it is giving me errors.

Code:

$id = $_GET['id'];
$action = '['command'=>'get','target'=>'location']';

$query = "UPDATE ZeusUsers SET action = '$action' WHERE notification_id = '$id'";
$result = mysqli_query($link,$query) or exit("Error in query: $query. " . mysqli_error());

Error:

Parse error: syntax error, unexpected 'command'

If I change the $action to a standard word the statement works fine, it just seems to have issues with the single quotes and square brackets.

I've also tried using \ in front of the single quotes and it still fails.

Any ideas?

What is that $action supposed to be? The syntax is completely broken as is. Should it be an array? — Erik
– Erik, Commented Apr 2, 2015 at 13:44
It's JSON that I need to call later on, so storing it in the DB until I need to call it. — Ben Clarke
– Ben Clarke, Commented Apr 2, 2015 at 13:46
If $id is an int cast it that way as the minimum to prevent injections. $id = (int)$_GET['id'];. Other ways to prevent injections, stackoverflow.com/questions/60174/… — chris85
– chris85, Commented Apr 2, 2015 at 13:53

D-Rock · Accepted Answer · 2015-04-02 13:47:12Z

2

let php build the json string for you

$action = json_encode(array('command'=>'get','target'=>'location'));

You are starting and stoping a string literal with the single quotes so php is interpreting command as php code but it doesn't know what that keyword is.

answered Apr 2, 2015 at 13:47

D-Rock

2,6661 gold badge21 silver badges27 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Ben Clarke Over a year ago

Produces the the following error:

Warning: mysqli_error() expects exactly 1 parameter, 0 given in /assets/scripts/location.php on line 10 Error in query: UPDATE ZeusUsers SET action = '['command'=>'get','target'=>'location']' WHERE notification_id = '1111'.

Ben Clarke Over a year ago

Just used \ before all single quotes and seems to fix it! Thanks!

D-Rock Over a year ago

just noticed how you are interpolating the $action variable in the query. You really should be using prepared statements there. That would have solved the problem and is more secure.

Collectives™ on Stack Overflow

PHP SQL Statement not accepting Variable

1 Answer 1

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related