mysql UPDATE error

[arm207]

hi,
the following results in "Invalid SQL syntax error".
I tried a few different options but none seemed to have worked. Would someone please help. I believe the error is around/after the WHERE statement.

$query = "UPDATE ATAMA_users SET ".
"user_name = \"" . $formVars["username"] . "\", " .
"user_passwd = \"" . $formVars["loginPassword"] . "\", " .
"user_firstname = \"" . $formVars["firstname"] . "\", " .
"user_lastname = \"" . $formVars["lastname"] . "\", " .
"user_email = \"" . $formVars["email"] . "\", " .
"user_phone = \"" . $formVars["phone"] . "\" .
" WHERE user_id = " . $userID . "\"" ;

 

[mbrooks]

Here you go

$query = "UPDATE ATAMA_users SET ".
"user_name = \"" . $formVars["username"] . "\", " .
"user_passwd = \"" . $formVars["loginPassword"] . "\", " .
"user_firstname = \"" . $formVars["firstname"] . "\", " .
"user_lastname = \"" . $formVars["lastname"] . "\", " .
"user_email = \"" . $formVars["email"] . "\", " .
"user_phone = \"" . $formVars["phone"] . "\" .
" WHERE user_id = \"" . $userID . "\"";

M. Brooks

http://mbrooks.info

 

[arm207]

hi,
I tried that, but its now giving this error message...

Parse error: parse error, unexpected T_STRING

 

[arm207]

the error is pointing to the following line...
" WHERE user_id = \"" . $userID . "\"";

 

[towerbase]

Does $userID contain a " ?

Andrew
Hampshire, UK

 

[LucL]

Simply adding quotes, ex: \"" to the insert doesn't do the trick because fields that contain quotes or ' or other characters will result in MYSQL errors.

MYSQL has a "prepare" function that returns the given variable for input into the database.

ex:
in perl you can do something like this
$fixed= $dbh->quote($formVars["username"]);

However, you seem to be using PHP so it probably has its own way of interfacing with the mysql variable preparation handler.

 

[vacunita]

You are missing a set of bouble quotes before the where clasue:

$query = "UPDATE ATAMA_users SET ".
"user_name = \"" . $formVars["username"] . "\", " .
"user_passwd = \"" . $formVars["loginPassword"] . "\", " .
"user_firstname = \"" . $formVars["firstname"] . "\", " .
"user_lastname = \"" . $formVars["lastname"] . "\", " .
"user_email = \"" . $formVars["email"] . "\", " .
"user_phone = \"" . $formVars["phone"] . "\"[red]"[/red] .
" WHERE user_id = " . $userID . "\"" ;

----------------------------------
Ignorance is not necessarily Bliss, case in point:
Unknown has caused an Unknown Error on Unknown and must be shutdown to prevent damage to Unknown.