Please correct the syntax

[rohit54]

hi,

this is a part of my code where i get error

case 'Modify Account':
if (isset($POST['name'])and isset($POST['email'])and isset($POST['accesslvl'])and isset($POST['userid']))
{
$sql = "UPDATE cms_users " .
"SET email='" . $POST['email'] .
"', name='" . $POST['name'] .
"', access_lvl=" . $POST['accesslvl'] . " " .
"WHERE user_id=" . $POST['userid'];
mysql_query($sql, $conn) or die("Could not update user account." . mysql_error());
}
redirect('admin.php');
break;

i get this error:
Could not update user account.You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1

Please correct the syntax i tried a lot but unable to do it

with regards,
Rohit Sinha

[paulnaj]

Hi,

Actually the syntax looks OK - but only if $POST['accesslvl'] are $POST['userid'] are integers.

One way to try and find out what's going on is to echo out the $sql to the browser and see if it's what you expect.

P.

PS. Just a tip - you could have written the sql string like ...

<?php
$sql = "
UPDATE cms_users
SET	email = '".$_POST['email']."'
, 	name = '" . $_POST['name']."'
, 	access_lvl = ".$_POST['accesslvl']."
WHERE user_id = " . $_POST['userid']."
";
?>

... which is a bit more readable!

P 😉