MySQL query adding ' to variable

Question

A MySQL query that I am running is throwing up the following error

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'desc = 'Enter Description Here'' at line 2

The desc is a variable '$desc' the error suggests that there is an extra ' before desc but there is nothing in the code (below) if I remove desc altogether it works fine (obviously not updating that part) its very strange, your help is greatly appreciated :-)

The code is

//Get the form data
    $title = $_POST['title'];
    $keywords = $_POST['keywords'];
    $desc = $_POST['desc'];



//initialise connection with databse

require_once('../Connections/EliteGrooming.php');
mysql_select_db($database_EliteGrooming, $EliteGrooming);

//Execute the query

mysql_real_escape_string($title, $keywords, $desc);

$query = "
    UPDATE site_settings
    SET site_title = '$title', keywords = '$keywords', desc = '$desc';";

mysql_query($query) or die(mysql_error());
mysql_close();
header('Location: ../admin/site-settings.php?updated');

score 5 · Accepted Answer · edited May 23 '17 at 12:16

5

desc is a reserved keyword, you must escaped it with backtick

$query = "
    UPDATE site_settings
    SET site_title = '$title', keywords = '$keywords', `desc` = '$desc';";

but your query is vulnerable with SQL Injection, please read the article below,

How can I prevent SQL injection in PHP?

edited May 23 '17 at 12:16

Community

1
1

answered Nov 17 '12 at 16:40

John Woo

258,903
69
498
492

Thank you for your help, it worked great! I added mysql_real_escape_string($title, $keywords, $desc); does this not prevent against SQL injection? again thank you so much for your help. – AppleTattooGuy Nov 17 '12 at 16:46
@JamesLeist [SQL injection that gets around mysql_real_escape_string()](http://stackoverflow.com/a/5741264/491243) – John Woo Nov 17 '12 at 16:48
@JamesLeist you are always welcome :D – John Woo Nov 17 '12 at 16:55

score 3 · Answer 2 · answered Nov 17 '12 at 16:40

3

You need to escape reserved words in MySQL like desc with backticks

UPDATE site_settings
SET site_title = '$title', keywords = '$keywords', `desc` = '$desc';";

answered Nov 17 '12 at 16:40

juergen d

201,996
37
293
362

MySQL query adding ' to variable

2 Answers2