PHP MySQL UPDATE causing error

Question

I was having a look around but I did not seem to find the right answer to this problem I am having. Whenever I run this UPDATE MySQL script, it calls the error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Email='[email protected]', Phone='123456780', Address='16 Remote Street',' at line 1

Here is the code I am using to get this error.

<?php 
include ('cfg_prop.php');
$firstname = $_POST['firstname'];
$lastname = $_POST['lastname'];
$email = $_POST['email'];
$secondemail = $_POST['secondary'];
$phone = $_POST['phone'];
$address = $_POST['address'];
$country = $_POST['country'];
$postcode = $_POST['postcode'];
$company = $_POST['company'];
$city = $_POST['city'];

$sql = "UPDATE users SET Firstname='$firstname', Lastname='$lastname', Email='$email', Secondary Email='$secondemail', Phone='$phone', Address='$address', Country='$country', Postcode='$postcode', Company='$company', City='$city' WHERE Username='$userss'";
mysql_query($sql) or die(mysql_error());
?>

If anyone could help me, I would be really happy and grateful as I just can't seem to get over this. Thanks in advance for the help.

Alter Arch

Thank's everyone for your help. It worked. I really appreciate it guys! — William Burnside
– William Burnside, Commented Nov 8, 2011 at 11:59
When you have decided which answer is the most helpful to you, mark it as the accepted answer by clicking on the check box outline to the left of the answer. stackoverflow.com/faq#howtoask — hsz
– hsz, Commented Nov 8, 2011 at 12:10

hsz · Accepted Answer · 2011-11-08 11:53:33Z

6

First of all - you have to escape data from $_POST superglobal because of easy SQL Injection attack.

$email = mysql_real_escape_string($_POST['email']);

Next thing you canno use Secondary Email because there is whitespace that causes an error.

You have to change colmun's name to Secondary_Email.

Or just use

`Secondary Email`

instead (but do not do this - columns should not have whitespaces in their names).

answered Nov 8, 2011 at 11:53

hsz

153k63 gold badges268 silver badges320 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

William Burnside Over a year ago

Thank's for the security tip!

Nathan Q · Accepted Answer · 2011-11-08 11:51:09Z

1

Secondary Email

Column has a space in it's name; you should use backtick symbol :

`

So:

$sql = "UPDATE users SET Firstname='$firstname', Lastname='$lastname', Email='$email', `Secondary Email`='$secondemail', Phone='$phone', Address='$address', Country='$country', Postcode='$postcode', Company='$company', City='$city' WHERE Username='$userss'";

answered Nov 8, 2011 at 11:51

Nathan Q

1,90220 silver badges43 bronze badges

1 Comment

William Burnside Over a year ago

Thank you so much. That was the fastest reply so I am voting your's up. It worked!

Marco · Accepted Answer · 2011-11-08 11:53:48Z

1

Try this:

UPDATE users SET 
    Firstname='$firstname', 
    Lastname='$lastname', 
    Email='$email', 
    `Secondary Email`='$secondemail', 
    Phone='$phone', 
    Address='$address', 
    Country='$country', 
    Postcode='$postcode', 
    Company='$company', 
    City='$city' 
WHERE Username='$userss'

Secondary Email must be enclosed in backticks because contains a whitespace.
Remember to sanitize user input to avoid SQL Injection.

answered Nov 8, 2011 at 11:53

Marco

57.7k15 gold badges135 silver badges159 bronze badges

2 Comments

William Burnside Over a year ago

Thanks, I wanted to keep it all in one line though just so it is compact.

Marco Over a year ago

@DarayusNanavati: you can keep it in one line. My solutions is just more readable, but you can strip newlines away!!

Ragnar123 · Accepted Answer · 2011-11-08 11:54:27Z

0

Escape the field Secondary Email

$sql = "UPDATE users SET Firstname='$firstname', Lastname='$lastname', Email='$email', `Secondary Email`='$secondemail', Phone='$phone', Address='$address', Country='$country', Postcode='$postcode', Company='$company', City='$city' WHERE Username='$userss'";

answered Nov 8, 2011 at 11:54

Ragnar123

5,2104 gold badges27 silver badges34 bronze badges

Comments

JellyBelly · Accepted Answer · 2011-11-08 11:56:30Z

0

try this:

$sql = "UPDATE `users` SET `Firstname`='$firstname', `Lastname`='$lastname', `Email`='$email', `Secondary Email`='$secondemail', `Phone`='$phone', `Address`='$address', `Country`='$country', `Postcode`='$postcode', `Company`='$company', `City`='$city' WHERE `Username`='$userss'";

but this method of writing a query is highly recommended by SQL injection!

answered Nov 8, 2011 at 11:56

JellyBelly

2,4312 gold badges21 silver badges42 bronze badges

2 Comments

William Burnside Over a year ago

Wasn't entirely sure if you were being sarcastic on the SQL injection bit but I am looking into mysql_real_escape_string now

JellyBelly Over a year ago

good! Always use the function mysql_real_escape_string() when you take data via post!

Collectives™ on Stack Overflow

PHP MySQL UPDATE causing error

5 Answers 5

1 Comment

1 Comment

2 Comments

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

1 Comment

1 Comment

2 Comments

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related