0

I got this error while trying to update information in mysql server:

'Uncaught PDOException: SQLSTATE[42000]: Syntax error or access violation: 1064
You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '* FROM ogrenci WHERE ID=' at line 1 in D:\Php\xampp\htdocs\workworkwork\index.php:78
Stack trace:
#0 D:\Php\xampp\htdocs\workworkwork\index.php(78): PDOStatement->execute()
#1 {main} thrown in D:\Php\xampp\htdocs\workworkwork\index.php on line 78'

How can i solve this?

        $id=$_REQUEST['ID'];
        $sql = "SELECT * FROM ogrenci WHERE ID=$id";
        $sonuc= $db->prepare($sql);
        $sonuc->execute();
        $rs=$sonuc->fetch(PDO::FETCH_ASSOC);
Paul T.
  • 4,703
  • 11
  • 25
  • 29
selcukctn
  • 233
  • 3
  • 13
  • 3
    You can solve it by using properly prepared statements and thereby avoiding [SQL injections](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php). – Markus AO Mar 30 '22 at 20:56
  • 2
    There's no point using prepared statements if you don't also use **parameters** with them. Look again at examples of the use of pdo prepared statements to see. It might also fix your issue (unless the problem is simply that $id is empty) – ADyson Mar 30 '22 at 21:32

0 Answers0