Mysql update using php variable giving error

Question

I hope someone can help me with this one

I have a page displaying different members of a sports team when user clicks on a specific player a new page opens 'edit.php' where the selected(clicked) players info is displayed in a form. (Information such as name, lastname, phone nr and email is contained within the form)

Lets say the players name changed (very unlikely but just an example) the coach can update it. When he clicks the submit button the database should get updatated with the new information

However when I change the name to John and click submit I get the following error: Query failed:Unknown column 'John' in 'field list'

Ive spend the last couple of hours debugging this with no luck, would greatly appreciate it if someone can point me in the right direction. Code follows:

    if(isset($_POST['submit'])){
$firstname = $_POST['firstname'];

$query = "UPDATE player_info SET name =".$firstname." WHERE player_id =".$selectedplayer;
mysql_query($query)
or die ("Query failed:" .mysql_error());
}//end if

else
{
echo '<form name="update" method="post">';
while($row =mysql_fetch_array($result)){

 $name = $row['name'];
 $surname = $row['surname'];
 $phone = $row['contact_number'];
 $email =$row['email'];
 $position = $row['position'];  

echo "Name: <input type=\"text\" value= '$name' name='firstname' /><br>";
echo "Last Name: <input type=\"text\" value= '$surname' /><br>";
echo "Phone nr: <input type=\"text\" value= '$phone' /><br>";
echo "Email: <input type=\"text\" value= '$email' /><br>";
echo "Position: <input type=\"text\" value= '$position' /><br>";    
} //end while
} //end else

echo'<input type="submit" name="submit">';
echo'</form>';

Someone is going to tell you about PDO and prepared statements and how the code you're using is open to sql injection .. but it's not me :) — FreudianSlip, Sep 17 '13 at 07:34

score 5 · Answer 1 · edited May 25 '19 at 14:18

You need some quotes around your $firstname variable. (Where your field isn't an integer):

$querie = "UPDATE player_info SET name ='".$firstname."' WHERE player_id =".$selectedplayer;

I'm assuming you are using 'John' in your input. Because you've left out the quotes, your MySQL looks like SET name=John and since MySQL can't find 'John' as a field, it tells you.

Never-the-less:

Please, don't use mysql_* functions in new code. They are no longer maintained and are officially deprecated. See the red box? Learn about prepared statements instead, and use PDO, or MySQLi - this article will help you decide which. If you choose PDO, here is a good tutorial.

score 1 · Answer 2 · edited Sep 18 '16 at 20:55

1

Try with quotes around the name like this

'".$firstname."'

$query = "UPDATE player_info SET name ='".$firstname."' WHERE player_id =".$selectedplayer;

edited Sep 18 '16 at 20:55

marc_s

732,580
175
1,330
1,459

answered Sep 17 '13 at 07:33

sharafatalee

134
3

Mysql update using php variable giving error

2 Answers2