0

I am getting this error

Fatal error: Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'l;''', inf = 'gjuhkl;l;', rep='' WHERE id = '1'' at line 1 in C:\xampp\htdocs\WinnersOnlineHospital\Reply.php:49 Stack trace: #0 C:\xampp\htdocs\WinnersOnlineHospital\Reply.php(49): mysqli->query('UPDATE quiz SET...') #1 {main} thrown in C:\xampp\htdocs\WinnersOnlineHospital\Reply.php on line 49.

My code is okay and I don't see any where I made a mistake. What can be the problem? Here is my code:

<?php
if (isset($_GET['id'])) {
    $edit_id = $_GET['id'];
    include 'connect.php';

    $sql = "SELECT * FROM quiz WHERE id = '$edit_id'";
    $results = $conn->query($sql);

    if ($results->num_rows > 0) {
    while ($row = $results->fetch_assoc()) {
    $db_id = $row['id'];
    $db_phn = $row['phn'];
    $db_top = $row['top'];
    $db_inf = $row['inf'];
    $db_rep = $row['rep'];
    }
}
// 
}
?>
 <!DOCTYPE html>
<html lang="en">
<head>
    <title>Edit</title>
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
</head>
<body>
<form method="post">
    <input type="text" name="id" value="<?php echo $db_id; ?>" placeholder="Id">&nbsp;&nbsp;
    <input type="text" name="phn" value="<?php echo $db_phn; ?>" placeholder="Phone number">&nbsp;&nbsp;
    <input type="text" name="top" value="<?php echo $db_top; ?>" placeholder="Topic of inquiry">&nbsp;&nbsp;
    <input type="text" name="inf" value="<?php echo $db_inf; ?>" placeholder="Full information">&nbsp;&nbsp;
    <input type="text" name="rep" placeholder="Reply">&nbsp;&nbsp;
    <input type="submit" name="update" value="Update">
</form>

  <?php
    if (isset($_POST['update'])) {
        $id = $_POST['id'];
        $phn = $_POST['phn'];
        $top = $_POST['top'];
        $inf = $_POST['inf'];
        $rep = $_POST['rep'];

        require_once 'connect.php';

        $sql = "UPDATE quiz SET phn = '$phn', top = '$top', inf = '$inf', rep='$rep' WHERE id = '$id'";

        if ($conn->query($sql) === TRUE) {
            header('Location: ViewI.php');
        }else{
            echo "Failed to update".$conn->error;
        }
    }
?>
</body>
</html>
user3783243
  • 5,368
  • 5
  • 22
  • 41
Winners
  • 21
  • 1
  • 1
    **Warning:** You are wide open to [SQL Injections](https://php.net/manual/en/security.database.sql-injection.php) and should use parameterized **prepared statements** instead of manually building your queries. They are provided by [PDO](https://php.net/manual/pdo.prepared-statements.php) or by [MySQLi](https://php.net/manual/mysqli.quickstart.prepared-statements.php). Never trust any kind of input! Even when your queries are executed only by trusted users, [you are still in risk of corrupting your data](http://bobby-tables.com/). [Escaping is not enough!](https://stackoverflow.com/q/32391315) – Dharman Feb 27 '22 at 13:48
  • Your `header('Location: ViewI.php');` also won't work. You can't have output before a header call. Move the interaction prior to output. – user3783243 Feb 27 '22 at 13:52

0 Answers0