Adding issues.

NZ_Kiwis

This is my code and SQL table, I it echo's the value of $AdminComments okay but when I delete what it there and add some new it does not updates, there is currently 55555 in the DB, if i add 44 to 555544 it saves but nothing else works.. what's wrong?

<?php 
$JobNumber = $_POST['JobNumber'];
$submit = $_POST['submit'];
$AdminComments = $_POST['AdminComments'];


echo $JobNumber;
echo $submit;
echo $AdminComments;

if ($submit == "Complete") {

$AdminComments = $_POST['AdminComments'];
$result2 = MYSQL_QUERY("update Assist set Completed  = '1', AdminComments = $AdminComments where JobNumber = $JobNumber");


} else {

$result = MYSQL_QUERY("UPDATE Assist set AdminComments = $AdminComments where JobNumber = $JobNumber");
}
?>

My SQL table...

CREATE TABLE Assist (
JobNumber int(10) NOT NULL auto_increment,
Breif varchar(50) NOT NULL,
Details text NOT NULL,
From varchar(50) NOT NULL,
Email varchar(100) NOT NULL,
Link varchar(250) NOT NULL,
AdminComments text NOT NULL,
Completed int(10) NOT NULL,
KEY JobNumber (JobNumber)
) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=latin1 AUTO_INCREMENT=2 ;

bradgrafelman

If you're passing a string value (e.g. the replacement for the AdminComments column), then you must identify it as a string, just like you would in PHP: surround it with (single) quotes.

On the other hand, for fields such as Completed, since you're passing an integer there is no need for quotes (in fact, you probably souldn't have them).

Also, don't forget to sanitize user-supplied data using a function such as [man]mysql_real_escape_string/man, else you're leaving yourself vulnerable to SQL injection attacks.