MySQL Syntax Error During UPDATE

Question

if($_POST['submit'])
{
    $Day1 = $_POST['day1'];
    $Day2 = $_POST['day2'];
    $Day3 = $_POST['day3'];
    $Day4 = $_POST['day4'];
    $Day5 = $_POST['day5'];
    $Day6 = $_POST['day6'];
    $Day7 = $_POST['day7'];
    $Day8 = $_POST['day8'];
    $Day9 = $_POST['day9'];
    $Day10 = $_POST['day10'];
    $Day11 = $_POST['day11'];
    $Day12 = $_POST['day12'];
    $Day13 = $_POST['day13'];
    $Day14 = $_POST['day14'];

    $query_update = ("UPDATE user_glucose SET (Day1='$Day1',Day2='$Day2',Day3='$Day3',Day4='$Day4',Day5='$Day5',Day6='$Day6',Day7='$Day7',Day8='$Day8',Day9='$Day9',Day10='$Day10',Day11='$Day11',Day12='$Day12',Day13='$Day13',Day14='$Day14') WHERE username='$username'");

    $result_update = mysql_query($query_update);
    echo "Data Successfully Updated !";
    echo"<p>";
    echo mysql_error();
    echo"</p>";


}

I am trying to update the value from a form to the table named "user_glucose". But whenever I click on Submit this error pops up :

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '(Day1='10',Day2='10',Day3='0',Day4='0',Day5='0',Day6='0',Day7='0',Day8='0',Day9=' at line 1

I am very new to PHP and MySQL programming and I don't know what is the problem. Please help. Thank you.

You don't need the brackets around the fields you're updating. — andrewsi, May 14 '13 at 18:38
Lovely [SQL injection attack](http://bobby-tables.com) holes. Enjoy having your server pwn3d. — Marc B, May 14 '13 at 19:02

score 1 · Answer 1 · answered May 14 '13 at 18:39

1

Remove the parentheses around the SET values:

UPDATE user_glucose SET Day1='$Day1', ...

Your code is highly vulnerable to injection. You should use properly parameterized queries with PDO or mysqli.

answered May 14 '13 at 18:39

Explosion Pills

188,624
52
326
405

score 1 · Accepted Answer · edited May 23 '17 at 12:17

You don't need to use parenthesis in your UPDATE query, simply change to

    $query_update = ("UPDATE user_glucose SET Day1='$Day1',Day2='$Day2',Day3='$Day3',Day4='$Day4',Day5='$Day5',Day6='$Day6',Day7='$Day7',Day8='$Day8',Day9='$Day9',Day10='$Day10',Day11='$Day11',Day12='$Day12',Day13='$Day13',Day14='$Day14' WHERE username='$username'");

Then I would like to let you know that you are at risk of sql injection, have a look here How can I prevent SQL injection in PHP?. You should use prepared statment to avoid any risk

MikeB · Answer 3 · 2013-05-14T18:46:42.913

1

Try:

$query_update = "UPDATE user_glucose SET Day1='$Day1',Day2='$Day2',Day3='$Day3',Day4='$Day4',Day5='$Day5',Day6='$Day6',Day7='$Day7',Day8='$Day8',Day9='$Day9',Day10='$Day10',Day11='$Day11',Day12='$Day12',Day13='$Day13',Day14='$Day14' WHERE username='$username'";

edited May 14 '13 at 18:46

answered May 14 '13 at 18:40

MikeB

2,402
1
15
24

MySQL Syntax Error During UPDATE

3 Answers3