0

I keep getting this error message regarding mySQL syntax... I have been searching all over the web for the error and triple checked the names match with the ones on my SQL table... but nothing seems to do the job... can anyone see or know what the error is?

The error message:

You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ' `featured` = 'Yes', `active`...' at line 6

I have created other php files with the same exact variables and names, so I'm unsure as to why this error has come about.

<?php
if (isset($_POST['submit']))
{
    //echo "Button clicked";

    //1. get all the details from the form
    $id = $_POST['id'];
    $title = $_POST['title'];
    $description = $_POST['description'];
    $date_found = $_POST['date_found'];
    $current_image = $_POST['current_image'];
    $category = $_POST['category_id'];
    $featured = $_POST['featured'];
    $active = $_POST['active'];

    //2. uploa the image if selected
    if (isset($_FILES['image']['name'])) {
        //upload button clicked
        $image_name = $_FILES['image']['name'];

        if ($image_name != "") {
            //image is avaiable
            $ext = end(explode('.', $image_name));

            $image_name = "Item Name-" . rand(0000, 9999) . '.' . $ext;

            //get the source path and destination path
            $src_path = $_FILES['image']['tmp_name'];
            $dest_path = "../images/items/" . $image_name;

            //upload image
            $upload = move_uploaded_file($src_path, $dest_path);

            //heck whether the image is uploaded or not
            if ($upload == false) {
                //failed to upload
                $_SESSION['upload'] = "<div class='error'>failed to upload new image</div>";

                header('location:' . SITEURL . 'admin/manage-items.php');

                die();
            }
            // remove current image if available
            if ($current_image != "") {
                //current image is available
                //remove the image
                $remove_path = "../images/items/" . $current_image;

                $remove = unlink($remove_path);

                if ($remove == false) {
                    //failed to remove current image
                    $_SESSION['remove-failed'] = "<div class='error'>Failed to remove current image</div>";

                    header('location:' . SITEURL . 'admin/manage-items.php');

                    die();
                }
            }
        }
    } else {
        $image_name = $current_image;
    }

    //4. update the items in database
    $sql3 = "UPDATE tbl_item SET
        `title` = '$title',
        `description` = '$description',
        `date_found` = $date_found,
        `image_name` = '$image_name',
        `category_id` = $category,
        `featured` = '$featured',
        `active` = '$active'
        WHERE id=$id
        ";

    $res3 = mysqli_query($conn, $sql3) or die(mysqli_error($conn));

    if ($res3 == true) {
        $_SESSION['update'] = "<div class='success'>Item Updated successfully</div>";
        header('location:' . SITEURL . 'admin/manage-items.php');
    } else {
    }

    //redirect to manage with session message
    $_SESSION['update'] = "<div class='success'>item Updated successfully</div>";
    header('location:' . SITEURL . 'admin/manage-items.php');
}
?>
Bill Karwin
  • 538,548
  • 86
  • 673
  • 828
  • 2
    Learn about prepared statements to prevent sql-injection – Jens Aug 28 '22 at 18:00
  • please add the complete error message – Jens Aug 28 '22 at 18:00
  • You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ' `featured` = 'Yes', `active`...' at line 6 – rbaffourata Aug 28 '22 at 18:03
  • 2
    Provide: (#1) complete SQL code obtained in `$sql3` variable; (#2) complete error message received for this SQL code. – Akina Aug 28 '22 at 18:37
  • 1
    What does `echo $sql3` output? – Janez Kuhar Aug 28 '22 at 18:56
  • Does this answer your question? [How can I prevent SQL injection in PHP?](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) – Progman Aug 28 '22 at 18:58

0 Answers0