[RESOLVED] Numbers > Letters :S

[Dvdbrink]

I'm trying to update a table for editing news, but its only working when I Update it with a number...doesn't work with letters.

if(isset($_POST['editnews']))
{
	$nid = $_POST['id'];
	$title2 = $_POST['title2'];
	$body2 = $_POST['body2'];


mysql_query("UPDATE news SET title = ".$title2." , body = ".$body2." WHERE id = ".$nid." ");
echo "Updated succesfully.";	
}

If you want to see my whole code for editing the news, ask it.

[Horizon88]

Chances are you need to put single quotes around your entry, like so:

mysql_query("UPDATE news SET title = '".$title2."', body ...");

You could also do this:

mysql_query('UPDATE news SET title = \''.$title2.'\', body = ...');

[Dvdbrink]

Oh thanks its working now. Its weird tho. It used to work without the ' when the input wasn't a variable.

[bradgrafelman]

All numeric data should be entered without quotes, all string-type data should be surrounded in quotes - it's the same as in PHP.

Also, it appears as though your script is vulnerable to SQL injection attacks; user-supplied data should never be placed directly into a SQL query. Instead, you should first sanitize it with a function such as [man]mysql_real_escape_string/man.

Don't forget to mark this thread resolved.