MYSQL Query error WHERE id = $id

Question

I'm creating and then editing a row in a table, however my edit mysql query in php is giving me an error that I can't figure out. Any help?

The creation query:

$query = "INSERT INTO timelines (
id, event_name, event_date, date_created, attendee_count, attendee_names, maximum_attendees, creator_id, creator_name, price, thumbnail
) VALUES (
'{$timelineID}', '{$event_name}', '{$event_date}', '{$date_created}', '{$attendee_count}', '{$attendee_names}', '{$maximum_attendees}', '{$creator_id}', '{$creator_name}', '{$price}', '{$thumbnail}'
)";

The edit query:

$query = "UPDATE timelines SET 
event_name = '{$event_name}', 
event_date = '{$event_date}', 
maximum_attendees = '{$maximum_attendees}', 
price = '{$price}', 
thumbnail = '{$thumbnail}',
WHERE id = {$timelineID}";

Error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE id =' at line 8

I hope those variables are sanitized and escaped. – Ja͢ck Dec 06 '12 at 03:36 — Ja͢ck, Dec 06 '12 at 03:36
Hello, little [Bobby Tables](http://bobby-tables.com/). – Amadan Dec 06 '12 at 03:38 — Amadan, Dec 06 '12 at 03:38
why not first try `or die(mysql_error())` ??? – NullPoiиteя Dec 06 '12 at 03:45 — NullPoiиteя, Dec 06 '12 at 03:45

score 10 · Accepted Answer · edited May 23 '17 at 12:21

10

you have an extra comma before the WHERE clause. just remove it and it will work fine.

thumbnail = '{$thumbnail}',
                          ^ here
WHERE ...

final query,

$query = "UPDATE timelines SET 
event_name = '{$event_name}', 
event_date = '{$event_date}', 
maximum_attendees = '{$maximum_attendees}', 
price = '{$price}', 
thumbnail = '{$thumbnail}'
WHERE id = {$timelineID}";

Your query is vulnerable with SQL INJECTION, please read the article below to learn how to protect from it.

How can I prevent SQL injection in PHP?

edited May 23 '17 at 12:21

Community

1
1

answered Dec 06 '12 at 03:35

John Woo

258,903
69
498
492

I tried that, now getting a different error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 7 – Daniel F. Dietzel Dec 06 '12 at 03:50
do you have extra space between `thumbnail = '{$thumbnail}'` and `WHERE id = {$timelineID}"`? – John Woo Dec 06 '12 at 03:56
check out the datatype of thumbnail – iJay Dec 06 '12 at 04:34
I figured it out. another careless mistake. it had to be WHERE id = '{$timelineID}' – Daniel F. Dietzel Dec 06 '12 at 04:50

MYSQL Query error WHERE id = $id

1 Answers1