Bad SQL syntax?

Question

I'm getting the following error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' DStormr', 'ddo.png', 'Online:' at line 1`

The sql is the following:

"UPDATE articulo SET '".$nombre."', '".$imagen."', '".$text."', '".$precio."', '".$popup."', ".$genero_id.
" WHERE id=".$id"";

What am I missing/not seeing?

have you escaped your variables properly? What do you see if you echo the query instead of running it? — Spudley, May 20 '13 at 21:14
Suggest you read up on the format for SQL UPDATE statements, and then learn how to use prepared statements — Mark Baker, May 20 '13 at 21:14
Yes, this syntax is wrong. Why not to learn a proper one from one of numerous tutorials? — Your Common Sense, May 20 '13 at 21:15
Good God; there's *so many* terrible PHP tutorials out there. — Robert Harvey, May 20 '13 at 21:17
You're missing all the `columname =` parts of the statement. — Barmar, May 20 '13 at 21:18
@Robert Harvey I'm testing this on my site and yes it was taken from a tutorial from the net... — eon, May 20 '13 at 21:19
Here's the PHP survival guide: http://stackoverflow.com/tags/php/info — Robert Harvey, May 20 '13 at 21:20
Thanks it was because i was missing the columname = thing. And im saying that link as gold Mr Robert Harvey. Hope i get less noob with mysql within time... — eon, May 20 '13 at 21:21
I really wish there was a way to flag a question with a severe issue like XSS or SQL injection and it would automatically direct to a community-edited resource. It can feel like I'm trying to put out a forest fire with a watering can when coaching people on how to do things the right way. — tadman, May 20 '13 at 21:27

score 1 · Accepted Answer · edited May 20 '13 at 21:27

1

When you do an UPDATE you need to SET key = 'value'.

edited May 20 '13 at 21:27

halfer

19,824
17
99
186

answered May 20 '13 at 21:18

chrislondon

12,487
5
26
65

No, never. Use proper SQL placeholders like `?` or `:value` instead of this. – tadman May 20 '13 at 21:26

Bad SQL syntax?

1 Answers1