Update Mysqli using variables

Question

I am new in PHP. I want to update a MySQL table using variables.

$sql = "UPDATE tableName 
           SET $variable1='$variable2' 
        WHERE table_no='$variable3'";

Thanks

Answer 1

Don't use mysqli_. Use PDO.

If you HAVE to use mysqli_, use a prepared statement:

 $mysqli = new mysqli("localhost", "my_user", "my_password", "world");
 $smth = $mysqli->prepare('UPDATE tableName SET '.$variable1.'=? WHERE table_no=?');

 $smth->bind_param($variable2, $variable3);

That should do it, though I didn't run it. I encourage you to use PDO, though:

$conn = new PDO("mysql:host=$hostdb; dbname=$namedb", $userdb, $passdb);
$query = $conn->prepare('UPDATE tableName SET '.$variable1.'=A WHERE table_no=B');
$query->bindParam('A', $variable2);
$query->bindParam('B', $variable3);

EDIT

Updated the mysqli section to use proper bind_param syntax.