What is wrong with my update cade?

Question

What is wrong with my code to update sql database the table is Informatie and i need to update the field Text.

$info =  nl2br($_POST["info"]);
    echo $info."<br>";
    $infoid = $_POST["infoid"];
    echo $infoid;
    echo "<br>Info ID : $infoid";
    $sql = "UPDATE Informatie set Text = $text WHERE InfoId = $infoid";
    $query = mysql_query("$sql");

the echo $info and $infoid are correct.

i tryd

$sql = "UPDATE Informatie set Text = $text WHERE InfoId = '$infoid'";

also but it didnt work to

What debugging have you tried? What is the simplest use case scenario? What error do you get? — John Conde, Feb 20 '13 at 14:58

score 1 · Accepted Answer · edited May 23 '17 at 12:04

1

string values must be quoted.

$sql = "UPDATE Informatie SET Text = '$text' WHERE InfoId = $infoid";

if InfoID is also a string, then you also need to wrap it with single quotes.

$sql = "UPDATE Informatie SET Text = '$text' WHERE InfoId = '$infoid'";

As a sidenote, the query is vulnerable with SQL Injection if the value(s) of the variables came from the outside. Please take a look at the article below to learn how to prevent from it. By using PreparedStatements you can get rid of using single quotes around values.

How to prevent SQL injection in PHP?

edited May 23 '17 at 12:04

Community

1
1

answered Feb 20 '13 at 14:58

John Woo

258,903
69
498
492

My fault it did work but i posted the $infoid wrong ! thx ! – Sven van den Boogaart Feb 20 '13 at 15:01
@user2091723 did it generates error? – John Woo Feb 20 '13 at 15:02
@user2091723 add quotes to the last '$InfoId' too. – Meherzad Feb 20 '13 at 15:02
@Meherzad if `InfoId` is int then no need to add single quote. But let's ask the OP for the datatype of `InfoId`. – John Woo Feb 20 '13 at 15:03

score 0 · Answer 2 · answered Feb 20 '13 at 15:00

0

$sql = "UPDATE Informatie set Text = '$text' WHERE InfoId = '$infoid'";

answered Feb 20 '13 at 15:00

Vijay Verma

3,660
2
19
27

score 0 · Answer 3 · answered Feb 20 '13 at 15:06

Apart from the quoting of strings, you seem to mix up the variable names; I am guessing that $text should be $info:

$sql = "UPDATE Informatie set Text = '" . mysql_real_escape_string($info) . "'
          WHERE InfoId = '" . mysql_real_escape_string($infoid) . "'";

Note that you need to escape your string to avoid your query from breaking if the text contains for example a ' character.

But you really should switch to PDO (or mysqli) and prepared statements with bound variables.

What is wrong with my update cade?

3 Answers3