SQL Update query using variables

Question

I am writing php to update a user's balance, but my UPDATE query seems to be throwing an error when it is executed.

    $student = $database->quote($_POST ["studentID"]);
    $amount = $database->quote($_POST ["update_balance"]);

    //sets query to update user balance
    $query = "UPDATE `User` SET `balance`= (`.$amount.`) WHERE `userID`= (`.$student.`)";
    //excecutes the query
    $database->exec($query);

The 'studentID' and 'update_balance' are names of input fields being captured in the HTML.

Possible duplicate of Reference - What does this symbol mean in PHP? — Chay22
– Chay22, Commented Jul 10, 2016 at 10:07

Jalali · Accepted Answer · 2016-07-10 10:14:06Z

1

remove (`. things . and run sql query

$query = "UPDATE `User` SET `balance`= '$amount' WHERE `userID`= '$student'";

edited Jul 10, 2016 at 10:14

Jalali

5964 silver badges19 bronze badges

answered Jul 10, 2016 at 10:04

Aniruddha Chakraborty

1,8621 gold badge22 silver badges33 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Georgie Lyme Over a year ago

This fixes the issue of it the error being thrown, however it is updating the balance from 'NULL' to 0. The type is an int and the input tag has a type of "number". Could it possibly be passing the $amount through as a string and converting that to 0?

Georgie Lyme Over a year ago

Apologies, i was referencing the wrong field in $amount. Should really check better before i ask silly questions.

Jalali Over a year ago

your problem solved or no? if no echo your query and paste it here

Aniruddha Chakraborty Over a year ago

@GeorgieLyme would you pleae mark this as a correct answer? :)

Tacsiazuma · Accepted Answer · 2016-07-10 10:20:03Z

0

You should use prepared statements as it's considered much safer than any string escaping mechanism:

$statement = $somePdoInstance->prepare("UPDATE user SET balance = :balance WHERE userId = :user_id");
$statement->execute(array(
   "balance" => $amount, // the values from POST
   "user_id" => $student
));

Now your update query should work fine and it's much safer.

answered Jul 10, 2016 at 10:20

Tacsiazuma

7765 silver badges17 bronze badges

Collectives™ on Stack Overflow

SQL Update query using variables

2 Answers 2

4 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related