SQL Error

[NZ_Kiwis]

$YR = $_POST['YR'];
$D1 = $_POST['D2'];
$D2 = $_POST['D1'];

$username = $_POST['username'];
$firsrname = $_POST['firstname'];
$lastname = $_POST['lastname'];
$address = $_POST['address'];
$city = $_POST['city'];
$country = $_POST['country'];
$phone = $_POST['phone'];
$email = $_POST['email'];
$mailing = $_POST['mailing'];
$status = $_POST['status'];
$closed = $_POST['closed'];
$closedreason = $_POST['closedreason'];
$level = $_POST['level'];
$accounttype = $_POST['accounttype'];
$banuserf = $_POST['banuserf'];

$dob = "$YR-$D2-$D1";

$result = mysql_query ("update members set username = '$username', password = '$password', firstname = '$firstname', lastname = '$lastname', dob = '$dob', address = '$address', city = '$city', country = '$country', phone = '$phone', email = '$email', mailing = '$mailing', status = '$status', closed = '$closed', closedreason = '$closedreason', level = '$level', accounttype = '$accounttype', banuserf = '$banuserf' where id = $id") or die("INSERT error: ".mysql_error());

INSERT error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1

[TobyRT]

try removing the space between mysql_query and ("

[NZ_Kiwis]

Nope, this does not fix it :-(

My SQL set up is

CREATE TABLE members (
id int(10) NOT NULL auto_increment,
username varchar(50) NOT NULL default '',
firstname varchar(50) NOT NULL default '',
lastname varchar(50) NOT NULL default '',
showname int(10) NOT NULL default '0',
status int(10) NOT NULL default '0',
dob date NOT NULL default '0000-00-00',
address varchar(100) NOT NULL default '',
city varchar(100) NOT NULL default '',
country varchar(100) NOT NULL default '',
phone varchar(100) NOT NULL default '',
email varchar(100) NOT NULL default '',
password varchar(100) NOT NULL default '',
respect varchar(200) NOT NULL default '0',
mailing int(2) NOT NULL default '0',
joindate date NOT NULL default '0000-00-00',
closed int(10) NOT NULL default '0',
closedreason varchar(250) NOT NULL default '',
level int(2) NOT NULL default '1',
accounttype int(10) NOT NULL default '4',
acctypestar date NOT NULL default '0000-00-00',
acctypeend date NOT NULL default '0000-00-00',
helping int(2) NOT NULL default '0',
image int(20) NOT NULL default '0',
forumtype int(10) NOT NULL default '1',
lastforumpost varchar(100) NOT NULL default '',
sig varchar(250) NOT NULL default '',
banuserf int(10) NOT NULL default '0',
bc06agree int(11) NOT NULL default '0',
confirmcode varchar(200) NOT NULL default '',
KEY id (id)

[NogDog]

I'd suggest using this pattern so that your die() outputs the query as it was actually sent to MySQL, letting you see if any PHP variables used in the query are not what you are expecting them to be:

$sql = "update members set username = '$username', password = '$password', 
firstname = '$firstname', lastname = '$lastname', dob = '$dob', address = '$address', 
city = '$city', country = '$country', phone = '$phone', email = '$email', 
mailing = '$mailing', status = '$status', closed = '$closed', 
closedreason = '$closedreason', level = '$level', accounttype = '$accounttype', 
banuserf = '$banuserf' where id = $id";

$result = mysql_query ($sql) or die("INSERT error: ".mysql_error()."<br>query: $sql");

[leatherback]

On top of that.. Do you REALLY trust your users with what they are sending you? If this goes on the web, you really should do some variable verification before sending it to the database engine.