[RESOLVED] Query fails because of Syntax error

moboter

Hello
I have build a nice query but it fails due to the syntax.
I just dont see where it fails
I've been looking for over 3 hours now tried all sorts if things
maybe someone can show me where the fault is.

$_GET['KSTid'];     

    $query = mysql_query("update kostenstellen SET 
    Baustelle='$_POST['Baustelle']', 
    kolonnenNr='$_POST['kolonnenNR']',
    Bauleiter='$_POST['Bauleiter']', 
    AuftragsNr='$_POST['AuftragsNr']', 
    Beginn='$_POST['Beginn']', 
    Ende='$_POST['Ende']', 
    Gruppe='$_POST['Gruppe']', 
    Status='$_POST['Status']',
    WHERE KSTid=$KSTid");
    if (!$query) {
    die('Fehler beim Update der '.$KSTid.': ' . mysql_error());
}

all the variables are filled

bradgrafelman

If you reference array items inside a double quoted string, you can't quote the array index unless you use the "complex syntax" (using curly braces).

Take a look at this section in the PHP manual.

moboter

Went through the link you gave didnt help querry still fails

$query = mysql_query("update kostenstellen SET 
    Baustelle= $baustelle,
    kolonnenNr= $kolonnenNr,
    Bauleiter= $bauleiter,
    AuftragsNr= $auftragsnr,
    Beginn= $beginn,
    Ende= $ende,
    Gruppe= $gruppe,
    status= $status
    WHERE kstID= $KSTid;");

syntax to use near 'ich WHERE kstID= 999' at line 9

I echoed all the POST variable to see if they were there : They are.
Ran the same query with PHP Myadmin: works no error messages.

bradgrafelman

I highly doubt you ran the exact same query in PMA, because now you're missing the single quotes around the string values in the query.

halojoy

If the field is INTEGER, number
you do not quote the value

If the field is TEXT or VARCHAR then value is string
and you need to quote it using '$string'

I do not know your fields. Only you know how CREATE TABLE is.
But here is a guess

$query = mysql_query("update kostenstellen SET
    Baustelle= '$baustelle',
    kolonnenNr= $kolonnenNr,
    Bauleiter= '$bauleiter',
    AuftragsNr= $auftragsnr,
    Beginn= $beginn',
    Ende= $ende,
    Gruppe= '$gruppe',
    status= '$status'
    WHERE kstID= $KSTid;");

moboter

That really was all I missed the single quotes arround the String values.
thank you for your patience.
Applause

bradgrafelman

Also, forgot to mention this earlier...

Don't forget that user-supplied data should never be placed directly into a SQL query. Instead, it must first be sanitized with a function such as [man]mysql_real_escape_string/man (or, if you're expecting an integer, cast it to an (int) or use [man]intval/man).