Trying to updating a column through php and mysql

Firas Rihan

Hello, so I'm trying to update a column (carID) in a table called users
but I'm getting the following error:
"syntax error, unexpected double-quote mark, expecting "-" or identifier or variable or number"

Can you help me figure out what's the problem in the code?

Expand|Select|Wrap|Line Numbers

 if($_SERVER["REQUEST_METHOD"] == "POST"){

  $ID=mysqli_real_escape_string($con, $_GET['ID']);

if(isset($_POST["rentit"])){

 $sql="UPDATE users SET carID = '$ID' WHERE username = $_SESSION["username"] ";

}}

Thanks A Lot!

Niheel

the $_SESSION["username"] variable needs quotes in the SQL statement

original

Expand|Select|Wrap|Line Numbers

 
$sql="UPDATE users SET carID = '$ID' WHERE username = $_SESSION["username"] ";
 

fix

Expand|Select|Wrap|Line Numbers

 $sql="UPDATE users SET carID = '$ID' WHERE username = '".$_SESSION["username"]."' ";
 

garyponting071

The explanation you are providing is really great.

bakertaylor28

This code has two big problems-
First you should always be using prepared statements to prevent SQL injection. The second, is that it is easier to avoid using
a session variable directly in SQL- it is better to set regular var to Session Var:

Expand|Select|Wrap|Line Numbers

 
<?php

session_start();

if ( !isset ($_POST['carid'] )) {

exit('please input a carid');

}

$username = $_SESSION['username'];

$carid = $_POST['carid'];
 
$host='database host';

$user ='database user';

$pass = 'database pass';

$dbname = 'database name';
 
$con = mysqli_connect($host, $user, $pass, $dbname);

$stmt = $con->prepare('UPDATE users SET carid= ? WHERE username= ?');

$stmt->bind_param('ss', $carid, $username);

$stmt->execute(); 

$stmt->close();

$con->close();

?>

This is unnecessary:

Expand|Select|Wrap|Line Numbers

 
if($_SERVER["REQUEST_METHOD"] == "POST") {
 
}

because form data will ALWAYS use post if we use this in html (And therefore we don't need to check for POST method) :

Expand|Select|Wrap|Line Numbers

<form action="/foo.php" method="post">

Trying to updating a column through php and mysql

Post your reply

Similar topics