use of variables

Patriot

I seem to be having an issue with the use of variables within my code. I have looked online for assitance, but I cannot locate any.

Here is the following snippet that I am having difficulty with, my comments are prefixed with ----.

if ($GET['id']) { ---- I used this because if($id) did not work.
$var_id = $GET['id']; ---- just echoing the id back.
echo $var_id;
if ($_POST['submit']) {
$sql = "UPDATE employees SET first='$first',last='$last',address='$address',position='$position' WHERE id=$id"; ---- My SQL statement fails. Again the use of $first, $last, etc. fails to update the database. However, if I declare variables, populate them and use them in the update, it will work. Just seems like a lot of work for something that should be simple.
$result = mysql_query($sql);
echo "Thank you! Information updated.\n";
} else {
// query the DB
$sql = "SELECT * FROM employees WHERE id=$var_id";
---- The use of the $var_id allowed the SELECT statement to work...

Any assistance would be appreciated.

laserlight

Where is $first, $last and $address coming from?
If it is coming from the $_POST array, you should use that.
In addition, if magic_quotes_gpc is set to 0, you'll need to use addslashes() on the incoming variables.

Instead of using if ($GET['id'])
you probably should use
if (isset($GET['id']))
or
if (!empty($_GET['id']))

depending on your need, since the id from query string may not be defined.

Patriot

I have attached the entire test update. I have read the following:

"with magic_quote_gpc = ON u don't need to addslashes() queries".

I hope this makes it clearer.