syntax error, unexpected T_VARIABLE

I have been trying to get past this error all day. I am unable to
determine why I get syntax error from the following code:
>
//modify a record
$myDataID = mysql_query("UPDATE members SET first_name = $name_update
WHERE email = $targetEmail", $connectID);
>
Can someone tell me what is wrong with this.
Thank You
Gerald Stanley

I have been trying to get past this error all day. I am unable to
determine why I get syntax error from the following code:
>
//modify a record
$myDataID = mysql_query("UPDATE members SET first_name = $name_update
WHERE email = $targetEmail", $connectID);
>
Can someone tell me what is wrong with this.
Thank You
Gerald Stanley

I have been trying to get past this error all day. I am unable to
determine why I get syntax error from the following code:
>
//modify a record
$myDataID = mysql_query("UPDATE members SET first_name = $name_update
WHERE email = $targetEmail", $connectID);
>
Can someone tell me what is wrong with this.

stanman wrote:>
It's off-topic, but you should try to escape the string inputs, or
avoid combining inputs to query completely by using parameterized
queries.
>
A simple version is "UPDATE members SET first_name = '" .
mysql_escape_string($name_update) . "' WHERE email = '" .
mysql_escape_string($targetEmail) . "'"
>
You would also need to make sure the client encoding is correct.
>
If you're using PHP5, you can use parameterized queries in mysqli or
PDO
>

stanman wrote:>
It's off-topic, but you should try to escape the string inputs, or
avoid combining inputs to query completely by using parameterized
queries.
>
A simple version is "UPDATE members SET first_name = '" .
mysql_escape_string($name_update) . "' WHERE email = '" .
mysql_escape_string($targetEmail) . "'"
>
You would also need to make sure the client encoding is correct.

If you're using PHP5, you can use parameterized queries in mysqli or
PDO