Mysql Update quotes

lowsky13

I have a real problem with quotes...any good explanation on when to use what type of quotes and when? My form is not updating the database...what did I do wrong?

mysql_query("UPDATE slideshow SET showname = '".mysql_real_escape_string($showname)."' WHERE username = '$user' AND showname= '$show'");

NogDog

You should escape all string values from external sources:

mysql_query("UPDATE slideshow SET showname = '" .
mysql_real_escape_string($showname) . "' WHERE username = '" .
mysql_real_escape_string($user) . "' AND showname= '" .
mysql_real_escape_string($show) . "'");

lowsky13

It didn't work...below is my code...$show=$_GET['show']; is up top of my php.
It is not updating...

//update title and description
$title = $POST['title'];
$description = $POST['description2'];
$showname = $POST['showname'];
$user = $SESSION['username'];

//Update the db
$query = mysql_query("UPDATE slideshow SET showname = '" .
mysql_real_escape_string($showname) . "' WHERE username = '" .
mysql_real_escape_string($user) . "' AND showname= '" .
mysql_real_escape_string($show) . "'");

//Do the results
$result = mysql_query($query);

// Check result
// This shows the actual query sent to MySQL, and the error. Useful for debugging.
if (!$result) {
$message = 'Invalid query: ' . mysql_error() . "\n";
$message .= 'Whole query: ' . $query;
die($message);
}

NogDog

OK, at least one of us is confused. 🙂

You don't appear to use the $title or $description values anywhere, but you use $show in the query without apparently defining it. It could just be a case of not seeing all the code, but I'm not sure what you really want to happen.

PS: Are you getting your die() error message, or is the query running but not doing anything? If the latter, for debugging after your first error check, you could also do:

if(mysql_affected_rows() == 0)
{
   user_error("No rows updated with query:<br />\n$query");
}

(You'll need display_errors turned on, or else look for the error in the PHP error log, or else use an alternative method of outputting the error.)

tron00

You set your variable as

$showname = $_POST['showname'];

But you have $show instead of $showname

mysql_real_escape_string($user) . "' AND showname= '" .
mysql_real_escape_string($show) . "'");