simple update query not working?

Question

After writing a whole lot of much more complicated code that works beautifully, THIS is the code that is giving me issues.

Simple form

<form action="res/scripts/editsubscriber.php" method="post">
<label for="name">Name: </label>
<input name="name" type="text" value="<?php echo $name; ?>">
...etc, etc...
</form>

Submits to this script:

  include('appvars.php');  
  if(isset($_POST['submit'])){
$id = $_POST['id'];
$name = $_POST['name'];
$email = $_POST['email'];
$month = $_POST['month'];
$day = $_POST['day'];
$year = $_POST['year'];
$date =  $_POST['date'];
$time = substr($date, 0, (stripos($date, " ")+1));
$time = str_replace($time, '', $date);
$created = $year.'-'.$month.'-'.$day.' '.$time;
$query = "UPDATE newslettersubscribers SET name = '$name', email = '$email', created = '$created' WHERE id = $id)";
mysqli_query($dbc, $query);
 }

It posts, I've echoed all of the variables, they change just fine, but it still won't update the database. Someone please tell me what i'm missing...

On a side note: You code is vulnerable for [SQL Injections](https://secure.wikimedia.org/wikipedia/en/wiki/Sql_injection)! — Veger, Nov 13 '12 at 00:50
Closing parentheses at the end of your UPDATE statement, but I don't see any opening parentheses? — mcriecken, Nov 13 '12 at 00:50
wow... wowowowowowowowowowowowowowow.... you have no idea how long i spent being so frustrated with this... *facepalm* — user1621945, Nov 13 '12 at 00:54

score 2 · Accepted Answer · edited May 23 '17 at 11:56

2

remove extra ) on your update statement
read article to avoid SQL Injection

Best way to prevent SQL injection in PHP?

edited May 23 '17 at 11:56

Community

1
1

answered Nov 13 '12 at 00:51

John Woo

258,903
69
498
492

score 0 · Answer 2 · answered Nov 13 '12 at 00:50

0

You got a strange trailing ) in your SQL query. Have you executed it in a SQL client ?

answered Nov 13 '12 at 00:50

i.am.michiel

10,281
7
50
86

score 0 · Answer 3 · answered Nov 13 '12 at 00:51

0

Do you have an ID form input?

<input name="id" type="text" value="<?php echo $id; ?>">

Also, you're not escaping sql/html.

answered Nov 13 '12 at 00:51

NoPyGod

4,905
3
44
72

score 0 · Answer 4 · answered Nov 13 '12 at 00:52

This code will compromise your database's security severely. Since none of the parameters are sanitized before being included in the query, anyone with basic security knowledge can take over your application in seconds.

To address the security issues and your bug, you may want to look into http://php.net/manual/en/pdo.prepared-statements.php

simple update query not working?

4 Answers4