0

This is my simple "give-android-my-data-script":

$email = $_POST["email"];
$column = $_POST["column"];
$data = $_POST["data"];
mysql_query( "UPDATE members SET '$column' = '$data' WHERE email = '$email'") or die( "database query failed!" );
echo "data retrieved" . $email . $column . $data;

Everything is working fine IF but if I change '$column' for example into active (which is a row)

Echo tells me all 3 variables are there, but "database query failed!", too

So I'm sitting here - without a clue - 02:22am in germany...

Maybe someone can help me find the mistake. Thanks.

Machado
  • 14,105
  • 13
  • 56
  • 97

1 Answers1

0

Make sure that the data inside $_POST["column"] has a matching column name in your members table.

mysql_query("UPDATE members SET `".$column."` = '".$data."' WHERE email = '".$email."'")

Your query is also very prone to SQL injections. You should be using MySQLi_* instead.

Community
  • 1
  • 1
Logan Wayne
  • 6,001
  • 16
  • 31
  • 49
  • thanks, forgot that " and ' stuff. Should go to sleep. And thanks for the hint with injection. I'll use pdo! :) –  Jan 30 '15 at 01:45