1

I've a customer table i that table in one i need to store data of customer as a text a declare that in db that varchar(1500) while am trying to update that field i getting following erro

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's standard dummy text ever since the 1500s, when an unknown printer took a galle' at line 1"

field name is "comments1 varchar(1500);"

My query is

$sql="UPDATE customer SET comments1='".$comments1."' WHERE sno='$sno'";

how to solve it...

user2034550
  • 37
  • 1
  • 2
  • 10

5 Answers5

4

before your query add this code

$comments1=mysql_real_escape_string($comments1);

<----your query goes here--->

sandeep
  • 375
  • 1
  • 2
  • 15
1

According to the error message:

...or the right syntax to use near 's standard dummy text ever since
                        error starts here ^

Probably you are inserting a value that has single quote (which breaks the sql statement causing syntax error) on it. This is an indicator that you have not sanitized the values before inserting it on the database. There are several ways to avoid from sql injection:

  • by using PDO
  • and the other one: MySQLi.

For more details, please browse on this link.

you can also use mysql_real_escape_string (but will soon be deprecated)

$var = mysql_real_escape_string($comments1);
$sql="UPDATE customer SET comments1='$var' WHERE sno='$sno'";
Community
  • 1
  • 1
John Woo
  • 258,903
  • 69
  • 498
  • 492
1

Your comment variable contains single quotes you need to escape them with addslashes function.

Try this

$sql="UPDATE customer SET comments1='".addslashes($comments1)."' WHERE sno='$sno'";
chandresh_cool
  • 11,753
  • 3
  • 30
  • 45
0

It seems your column name is comments not comments1. field name is "comments varchar(1500);" so change

$sql="UPDATE customer SET comments1='".$comments1."' WHERE sno='$sno'";

to

 $sql="UPDATE customer SET comments='".$comments1."' WHERE sno='$sno'";
Amir
  • 4,089
  • 4
  • 16
  • 28
0

Better try to use this function mysql_real_escape_string()

Manohar
  • 31
  • 5