Problem with UPDATE code!

enjoiskater

Hello

I have made this code to update my news

<?php
if(isset($_GET['news_id'])) {
    $news_id = $_GET['news_id'];

$opendb = mysql_connect("localhost", "root", "") or die(mysql_error());
mysql_select_db("spelkontroll_ne") or die(mysql_error());
    // Anslut till databasen
    $news_id = mysql_real_escape_string($news_id);
    if(!is_numeric($news_id)) {
        echo "Invalid newsId!";
    } else {
        $query = "SELECT * FROM news WHERE news_id='$news_id'";
        $result = mysql_query($query);
        $count = mysql_num_rows($result);
        if($count == 0) {
            echo "No news with that newsId!";
        } else {
            // Visa nyheten
$game_id=mysql_result($result,$i,"game_id");
$mapp=mysql_result($result,$i,"mapp");
$headline=mysql_result($result,$i,"headline");
$headlinesummary=mysql_result($result,$i,"headlinesummary");
$format=mysql_result($result,$i,"format");
$date=mysql_result($result,$i,"date");
$news=mysql_result($result,$i,"news");
$author=mysql_result($result,$i,"author");

    }
}
} else {
    echo "No news_Id has been set!";
}
?>
<html>
<head>
      <title>Bild Upload Test</title>
      <link type="text/css" rel="stylesheet" href="admin.css"/>
        <script src="ladda.js" type="text/javascript" language="javascript"></script>
        <script src="ladda2.js" type="text/javascript" language="javascript"></script>
        <script src="ladda3.js" type="text/javascript" language="javascript"></script>
        <script src="ladda4.js" type="text/javascript" language="javascript"></script>
</head>
<body>
<?php
// skriver information till den angivna tabellen
$news = mysql_query("UPDATE news SET game_id =$_POST[game_id], mapp =$_POST[mapp], headline =$_POST[headline], headlinesummary =$_POST[headlinesummary], format =$_POST[format], date =$_POST[date], news =$_POST[news], author =$_POST[author] WHERE news_id=$news_id")

or die("Kunde inte l&#228;gga till nyhet:<br />" . mysql_error());

// visar vilken kund som registrerats
echo "Nyheten &#228;r uppdaterad<br />";
echo "<br /><br /><a href='skrivnyheter.php'>tillbaka till formul&#228;ret </a><br />";
?>

<br />
<?php
// st&#228;nger databasen
mysql_close($opendb);
?>

</body>
</html>

But I cant get the code to work. I get this message when I try to execute the code:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Maj 08 - Mirrors Edge, headline =Kolla in!, headlinesummary =Vad då?, format =PS' at line 1

I can´t figure out what´s wrong, please help me.

bradgrafelman

Strings in MySQL must be surrounded with quotes (single quotes, to be precise) just as they do in PHP.
You should NEVER place user-supplied data directly into a SQL query! Instead, you must first sanitize it with a function such as [man]mysql_real_escape_string/man else you leave yourself vulnerable to SQL injection attacks. (Note that there are also other ways of sanitizing data; for example, you should cast the $_GET['news_id'] user input to an integer; that would ensure no malicious data can be entered and that the data is of the proper type.)
In this code:
```
$game_id=mysql_result($result,$i,"game_id");
$mapp=mysql_result($result,$i,"mapp");
$headline=mysql_result($result,$i,"headline");
$headlinesummary=mysql_result($result,$i,"headlinesummary");
$format=mysql_result($result,$i,"format");
$date=mysql_result($result,$i,"date");
$news=mysql_result($result,$i,"news");
$author=mysql_result($result,$i,"author");
```
where is $i ever set? If you're simply trying to retrieve the first row, you could do a few things to simplify the code: 1) Change the 'SELECT *' to SELECT only the columns you're going to use (even if that just so happens to be all columns in the database at the moment) and add "LIMIT 1" onto the end of the query; 2) Use [man]mysql_fetch_assoc/man to retrieve the row as an array; 3) [man]extract/man the array elements into their own variables.

That would reduce those 8 lines down to 2.