current community

your communities

more stack exchange communities

Stack Exchange
tour help
careers 2.0
Take the 2-minute tour ×
Stack Overflow is a question and answer site for professional and enthusiast programmers. It's 100% free, no registration required.
up vote 1 down vote favorite 
$id = $_REQUEST["Uid"];

$query = "update prd set name='".$_POST['nm']."', char='".$_POST['ch']."', price='".$_POST['pr']."', sp_pri='".$_POST['spr']."', is_eli='".$_POST['enb']."', upd='".$_POST['ud']."', img='".$_FILES['img']['name']."', c_id='".$_POST['cid']."' where id=".$id;

$r = mysql_query($query) or die(mysql_error());
if ($r == 1)
    echo "Record Updated";

I'm getting the following error from this query but I'm not sure how to solve it - the SQL looks OK to me! What am I doing wrong?

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'char='b', price='150', sp_pri='100', is_eli='Yes', upd='Mon Jul 23 2012 17:23:24' at line 1

share|improve this question
    
please format your code –  donald123 Jul 25 '12 at 8:24
5  
Say hello to SQL Injections. Tip : prefer use prepared statements, don't use mysql_* functions, and don't use $_POST variables in the request directly. –  Yellow Bird Jul 25 '12 at 8:25
1  
One more reason not to use the mysql extension is it's being deprecated (as is alluded to on most of the mysql manual pages). PDO and mysqli are the recommended extensions to use. Also, or die(mysql_error()) should never appear in production code, as die breaks HTML output and database error messages should never be revealed to non-admin users as it discloses too much information. –  outis Jul 25 '12 at 8:31
    
possible duplicate of PHP/MySQL Update code, Yii Framework/PDO getting error CDbCommand failed to execute the SQL statement: SQLSTATE[42000], Why does this SQL INSERT statement return a syntax error?, Syntax Error with MySQL Query –  outis Jul 25 '12 at 8:45
add comment

2 Answers

up vote 8 down vote

char is a reserved word within SQL. If you use such keywords as column names you must enclose them in backticks (as you should always do with column names)!

$query="update prd set `name`='".$_POST['nm']."', `char`='".$_POST['ch']."', `price`='".$_POST['pr']."', `sp_pri`='".$_POST['spr']."', `is_eli`='".$_POST['enb']."', `upd`='".$_POST['ud']."', `img`='".$_FILES['img']['name']."', `c_id`='".$_POST['cid']."' where `id`=".$id;

Furthermore by adding $_POST variables directly into a query without sanitizing them before, you open your system to any kind of attacks, that compromise your data and web site.

Have a look at mysqli and PDO to circumvent such problems.

share|improve this answer
add comment
up vote 1 down vote

In addition to Sirko's suggestions, in the assignment to field upd which is a date - you should use STR_TO_DATE

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.