[RESOLVED] UPDATE statement problems

woodplease

I'm posting values to a page so that i can use them to update a table. i know that the values have been posted because i have echoed them out on the other page. My problem is that whenever i load the page, i keep getting the following error:

Warning: pg_query() [function.pg-query]: Query failed: ERROR: parser: parse error at or near "question" in /berw/ugrad1/base/a/agd8/public_html/quizdom/questionupdated2.php on line 35

the code i'm using is

<?php
$quizno = $_POST['quizno'];
$questionno=$_POST['questionno'];
$question=$_POST['question'];
?>
<?php
$id = $_GET['id'];
echo'

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><link rel="stylesheet" type="text/css" href="sheet1.css" />
	<meta http-equiv="content-type" 
		content="text/html;charset=utf-8" />
	<meta http-equiv="Content-Style-Type" content="text/css" />
<title>Add Questions to a Quiz</title>
</head>
<body>
<div id="container">
<div id="header"></div>
<div id="maincontent">';
echo $quizno; //echoing out to see if values have been posted
echo $questionno;//echoing out to see if values have been posted
echo $question;//echoing out to see if values have been posted

 $query="UPDATE questions SET question=".$question. "WHERE quizref=".$quizno."AND questionno=".$questionno;
 $result = pg_query($query) or die ("Query failed");
 echo' Question updated';

echo'
 </div>
</div>
</body>
</html>'
?>

Any ideas on this would be great

Thanks

paulnaj

Hi,

There's a couple of things that look wrong with the SQL and I've made a few comments about other things...

<?php
// Check if POST values are as expected. Comment out when happy ...
echo '<pre>'; var_dump($_POST); echo '</pre>';

// Should do some validation here to stop nasty sql injection
// For example, could convert to integers
// assuming they are stored as integers in the db, of course
$quizno = (int) $_POST['quizno']; 
$questionno = (int) $_POST['questionno'];

// Here, at least use pg_escape_string() in the actual query
$question = $_POST['question'];

// Don't know what this bit is
// $id = $_GET['id'];

// Don't need to **echo** out everything ...
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<link rel="stylesheet" type="text/css" href="sheet1.css" />
<meta http-equiv="content-type" content="text/html;charset=utf-8" />
<meta http-equiv="Content-Style-Type" content="text/css" />
<title>Add Questions to a Quiz</title>
</head>
<body>
<div id="container">
	<div id="header"></div>
	<div id="maincontent">
<?php
// Make sure text field values are quoted
// and there is whitespace between SQL keywords etc ...
$query = '
UPDATE questions 
SET question = "'.$question.'"
WHERE quizref = '.$quizno.'
AND questionno = '.pg_escape_string($questionno).'
';

$result = pg_query($query) or die ("Query failed");
echo' Question updated';

// Again, you don't need to **echo** out everything ...
?>
	</div>
</div>
</body>
</html>

... hope it helps. P