please i want to edit data from database phhp

Question

[enter image description here](https://i.stack.imgur.com/dX0ru.png)

eror = Fatal error: Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '' at line 1 in /Applications/XAMPP/xamppfiles/htdocs/perpus/updatebuku.php:17 Stack trace: #0 /Applications/XAMPP/xamppfiles/htdocs/perpus/updatebuku.php(17): mysqli_query(Object(mysqli), 'UPDATE tb_buku ...') #1 {main} thrown in /Applications/XAMPP/xamppfiles/htdocs/perpus/updatebuku.php on line 17

<?php

include("config.php");

// cek apakah tombol simpan sudah diklik atau blum?
if(isset($_POST['save'])){

    // ambil data dari formulir
    $kdba = $_POST['kd_buku'];
    $jdla = $_POST['jdlbuku'];
    $pgra = $_POST['pengarang'];
    $pnra = $_POST['penerbit'];
    $tha = $_POST['thn'];

    // buat query update
    $sql = "UPDATE tb_buku SET judul_buku='$jdla', pengarang='$pgra', penerbit='$pnra', tahun='$tha' Where kd_buku=$kdba";
    $query = mysqli_query($db, $sql);

    // apakah query update berhasil?
    if( $query ) {
        // kalau berhasil alihkan ke halaman list-siswa.php
        header('Location: tbbuku.php');
    } else {
        // kalau gagal tampilkan pesan
        die("Gagal menyimpan perubahan...");
    }


} else {
    die("Akses dilarang...");
}

?>

Fatal error: Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '' at line 1 in /Applications/XAMPP/xamppfiles/htdocs/perpus/updatebuku.php:17 Stack trace: #0 /Applications/XAMPP/xamppfiles/htdocs/perpus/updatebuku.php(17): mysqli_query(Object(mysqli), 'UPDATE tb_buku ...') #1 {main} thrown in /Applications/XAMPP/xamppfiles/htdocs/perpus/updatebuku.php on line 17

(1) is `$kdba` a string ? (2) please use parameterized prepared statement to avoid SQL injection attacks — Ken Lee, Nov 17 '22 at 08:00

score 0 · Answer 1 · answered Nov 17 '22 at 08:06

$sql = "UPDATE tb_buku SET judul_buku='$jdla', pengarang='$pgra', penerbit='$pnra', tahun='$tha' Where kd_buku=$kdba";

if $kdba is String or null value actual query will change like this.

UPDATE tb_buku SET judul_buku='A', pengarang='B', penerbit='C', tahun='D' Where kd_buku=E

and E is missing ' sign.

but this is very dangurous code.

Because there is a risk of sql injection.

please i want to edit data from database phhp

1 Answers1