Updating info in MYSQL

[odie2828]

The following is my code and it doesnt up date the iformation.

Any suggestions?

<?php

include("config.php");

 if(isset($_POST['submit']))

{

  // Set global variables to easier names

 // and prevent sql injection and apostrophe to break the db.

  $title = mysql_escape_string($_POST['title']);

  $text1 = mysql_escape_string($_POST['text1']);









     $result = mysql_query("UPDATE 'news' SET 'title'='$title' AND 'text1'='$text1' WHERE 'newsid'='$newsid'",$connect);



      echo "<b>Thank you! News UPDATED Successfully!<br>You'll be redirected to Home Page after (4) Seconds";

      echo "<meta http-equiv=Refresh content=4;url=index.php>";

}

elseif(isset($_GET['newsid']))

{

    $result = mysql_query("SELECT * FROM news WHERE newsid='$_GET[newsid]' ",$connect);

    while($myrow = mysql_fetch_assoc($result))

         {

            $title = $myrow["title"];

            $text1 = $myrow["text1"];

?>

<br>

<h3>::Edit News</h3>

<form method="post" action="<?php echo $PHP_SELF ?>">

<input type="hidden" name="newsid" value="<? echo $myrow['newsid']?>">

Title: <input name="title" size="40" maxlength="255" value="<? echo $title; ?>">

<br>

Text1: <textarea name="text1" rows="7" cols="30"><? echo $text1; ?></textarea>

<br>

<input type="submit" name="submit" value="Update News">

</form>

<?

          }//end of while loop

}//end else

?>

[bradgrafelman]

1. When posting PHP code, please use the board's [noparse]

   [/noparse] BBcode tags as they make your code much easier to read. You should go back now and edit your post to include these tags.

2. When debugging SQL queries, you should always check to see if the query is failing and, if so, what MySQL has to say about it. The most common way to do this is to add an or die(mysql_error()) onto the end of the mysql_query() call. If you do so, you'll see that...

3. The problem in your query is that you surround pretty much everything in single quotes. Single quotes should only be used to delimit strings, not identifiers. Nothing needs to be used to delimit identifiers unless they are reserved words, in which case you should use backticks ( ` ).

4. Where is $newsid ever defined? Also note that numerical values shouldn't be quoted in queries - only strings.

5. Where is $PHP_SELF ever defined? Coupled with #4, it looks like your script depend(s/ed) on the register_globals directive, one that has long since been recognized as a security risk and thus deprecated. Instead, you should be sticking to the superglobals (manual: [man]variables.superglobals[/man]) (e.g. $_SERVER['PHP_SELF']).