Update mysql record using php not working

Question

I know the code is messy and very imperfect. However when trying to update a mysql record using the following code below, which I updated. Now it wont post into mysql database

Thanks for your help in advance

<?php
define('DB_NAME', 'comics');
   define('DB_USER', 'root');
   define('DB_PASSWORD', '');
   define('DB_HOST', 'localhost');

   $link = mysql_connect(DB_HOST, DB_USER, DB_PASSWORD);

   if (!link) {
    die('Could not connect: ' . mysql_error());
   }

   $db_selected = mysql_select_db(DB_NAME, $link);

   if (!$db_selected) {
    die('Can\'t use ' . DB_NAME . ': ' . mysql_error());
}

if (!isset($_GET['update'])){
        $q = "SELECT * FROM comics where ID = '$_GET[id]'";
        $result = mysql_query($q);
        $comics = mysql_fetch_array($result);
    }

if(isset($_GET['update']))
{


    $email = mysql_real_escape_string($_GET["email"]);
    $title = mysql_real_escape_string($_GET["title"]);
    $issue = mysql_real_escape_string($_GET["issue"]);
    $edition = mysql_real_escape_string($_GET["edition"]);
    $publisher = mysql_real_escape_string($_GET["publisher"]);
    $condition = mysql_real_escape_string($_GET["condition"]);
    $price = mysql_real_escape_string($_GET["price"]);

    $targetid = intval($_GET["id"]);

    $sql =  "UPDATE comics SET Email='$email', Title='$title',     Issue='$issue', Edition='$edition', Publisher='$publisher',     Quality='$condition', Cost='$price' WHERE ID = '$targetid' ";

$myData = mysql_query($sql,$link);
if(!$myData) {die(mysql_error());}

if ($myData == TRUE) {
header('Location: index.html');
exit();
    }
}

fixed the spelling error still dont know why I am getting the You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE ID = 'id'' at line 1 error. — Spencer, Apr 24 '16 at 02:15
Usually when it says there's a syntax error "near 'blah blah...", the error is right at the beginning of "blah blah..." — DaiBu, Apr 24 '16 at 02:27
removes the syntax error now the data isnt being updated. :( — Spencer, Apr 24 '16 at 02:28
running correctly but still no updating of database. Thank you all for your help — Spencer, Apr 24 '16 at 02:39
Not sure where you learned to use MySQL like this, but if it's a reference it's woefully out of date and you need a better one. [PHP the Right Way](http://www.phptherightway.com/) is a good place to start. — tadman, Apr 24 '16 at 02:49
`Issue='$isuse` is missing a closing quote. Which is why you should use proper concatenation - you'd see it right away. Also, remove the comma after `Cost='$price',` — Eihwaz, Apr 24 '16 at 03:08
@Eihwaz You're late to the party, man. That was four errors ago. Lol. — DaiBu, Apr 24 '16 at 03:13
Post your updated code Spencer, so I can see what you got so far. — DaiBu, Apr 24 '16 at 03:15
Oh, try using intval($_GET["id"]) instead of mysql_escape_string. — DaiBu, Apr 24 '16 at 03:24

score 3 · Answer 1 · edited May 23 '17 at 11:52

3

You're missing a ' in

Issue='$isuse,

That alone will break the rest of the query. And you misspelled issue. It should be

Issue='$issue',

You also have an extra comma right before your WHERE clause, and you use $id in your query, but you never defined that (I think you must mean $targetid). The whole thing should be:

$sql =  "UPDATE comics SET Email='$email', Title='$title',     Issue='$issue', Edition='$edition', Publisher='$publisher', Quality='$condition',     Cost='$price' WHERE ID = $targetid ";

You really should use an IDE like PHPStorm (no affiliation), which would have caught all of these problems for you, automatically.

That said, please don't use mysql_*; the mysql_* functions are outdated, deprecated, and insecure. They're removed entirely in PHP 7, and have been deprecated for a long time. Use MySQLi or PDO instead.

Also, you are wide open to SQL injection. This is a serious security vulnerability; your code should never be put into production until you fix that.

edited May 23 '17 at 11:52

Community

1
1

answered Apr 24 '16 at 02:05

elixenide

44,308
16
74
100

2

It's amazing how we have to include the disclamer! of don't use `mysql_*` even today... – vee Apr 24 '16 at 02:07
1

@vee Yeah, that library just won't die. – elixenide Apr 24 '16 at 02:07
He misspelled issue also. Might wanna update your answer. – DaiBu Apr 24 '16 at 02:10
@vee The sad part is that 99% of people who read the warnings of not using `mysqli_` functions and being vulnerable to sql injection will simply ignore it. It scares me that some of these people may go on to design systems that are put into production. – Luke Joshua Park Apr 24 '16 at 02:16
2

@LukePark, in addition my preference is PDO. I'm not yet certain to call it for sure but perhaps the point system in StackOverflow is what's encouraging people to ask question right away instead of reading any deprecation warning for that matter. – vee Apr 24 '16 at 02:21
`mysql_query` is gone in PHP 7 so it's only a matter of time before code like this doesn't do anything at all. – tadman Apr 24 '16 at 02:49
Missed the trailing comma – Funk Forty Niner Apr 24 '16 at 03:04
@Fred-ii- fixed, thanks. I caught yet another error when I went and looked at it again. This code is... not good. – elixenide Apr 24 '16 at 03:25

Update mysql record using php not working

1 Answers1