PHP / MySQL Update

[jbachris]

I had the following code which worked on a previous version of mysql. Now on my new server, with the latest mysql release it doesn't work.

if ( $_POST['edit_news'] ) {

$sql = "UPDATE news SET news_date = '" . $_POST['news_date'] . "', news_author = '" . $_POST['news_author'] . "', news_photo_main = '" . $_POST['news_photo_main'] . "', news_photo_sub = '" . $_POST['news_photo_sub'] . "', news_category = '" . $_POST['news_category'] . "', news_intro = '" . $_POST['news_intro'] . "', news_story = '" . $_POST['news_story'] . "', news_headline = '" . $_POST['news_headline'] . "', instory_photo = '" . $_POST['instory_photo'] . "', instory_image = '" . $_POST['instory_image'] . "', instory_caption = '" . $_POST['instory_caption'] . "' WHERE newsID=" . $_GET['newsID'] . "";
$add_rating_rs = $conn->Execute($sql) or die ( $conn->ErrorMsg() );

header ( "Location: http://www.xxxx.com/xx/index.php" );
exit;	
}

I get this error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1

[shonuff]

Comment out the header redirect at the bottom, and echo out $sql and it will make it easier to see the problem in your query string.

[jbachris]

Still got the same thing.

[jdorsch]

echo $sql before you try to do the query, then you can see your statement.

Also, putting a gigantic query on a single does not help with code readability.

[jbachris]

Here's a shorter one, same error:

$sql = "UPDATE didyouknow SET sport_id = '" . $_POST['sport_id'] . "', dyk_text = '" . $_POST['dyk_text'] . "' WHERE dyk_id=" . $_GET['dyk_id'] . "";

[Rodney_H_]

I would suggest you escape the values before insertion.

so, try this...

<?php

if(isset($_POST['edit_news'])) 
{
	// connect to database, then...


$sql = "UPDATE news 
		SET news_date = '".mysql_real_escape_string($_POST['news_date'])."', 
			news_author = '".mysql_real_escape_string($_POST['news_author'])."', 
			news_photo_main = '".mysql_real_escape_string($_POST['news_photo_main'])."', 
			news_photo_sub = '".mysql_real_escape_string($_POST['news_photo_sub'])."', 
			news_category = '".mysql_real_escape_string($_POST['news_category'])."', 
			news_intro = '".mysql_real_escape_string($_POST['news_intro'])."', 
			news_story = '".mysql_real_escape_string($_POST['news_story'])."', 
			news_headline = '".mysql_real_escape_string($_POST['news_headline'])."', 
			instory_photo = '".mysql_real_escape_string($_POST['instory_photo'])."', 
			instory_image = '".mysql_real_escape_string($_POST['instory_image'])."', 
			instory_caption = '".mysql_real_escape_string($_POST['instory_caption'])."' 
		WHERE newsID=".(int)$_GET['newsID']."
		LIMIT 1";

$add_rating_rs = $conn->Execute($sql) or die($conn->ErrorMsg());

header ("Location: http://www.xxxx.com/xx/index.php");
exit;	
}

?>