MySQL Update with variables in PHP

Question

mysql_connect('localhost', 'root', '')
        or die(mysql_error());
mysql_select_db('shuttle_service_system') 
or die(mysql_error());

$ID_No=$_POST['ID_No'];
$CurrentBalance = $_POST['CurrentBalance'];
$AddedAmount = $_POST['AddedAmount'];
$NewBalance = $CurrentBalance + $AddedAmount;

$sql = ("UPDATE balance
        SET Balance= '$NewBalance' 
        WHERE ID_No= '$ID_No' ");
$result=mysql_query($sql);

if($result){
        echo"Transaction successful!";
} else {
        echo "&nbsp Error";
}

Hi guys I'm trying to update my certain values in my database with the use of variables. It updates when I use brute force and not variables. I know my variables are working because I printed them before queuing the update.

Your code is vulnerable to SQL injections. You should read on how to prevent them in PHP. — Gumbo
– Gumbo, Commented Mar 23, 2014 at 7:22

Shankar Narayana Damodaran · Accepted Answer · 2014-03-23 06:53:22Z

1

Remove the paranthesis outside this UPDATE Statement

$sql = ("UPDATE balance
        SET Balance= '$NewBalance' 
        WHERE ID_No= '$ID_No' ");

It should be

$sql = "UPDATE balance
        SET Balance= '$NewBalance' 
        WHERE ID_No= '$ID_No' ";

Also, add this mysql_error() to read the exact error when your query fails.

$result=mysql_query($sql) or die(mysql_error());

This(mysql_*) extension is deprecated as of PHP 5.5.0, and will be removed in the future. Instead, the MySQLi or PDO_MySQL extension should be used. Switching to PreparedStatements is even more better to ward off SQL Injection attacks !

answered Mar 23, 2014 at 6:53

Shankar Narayana Damodaran

68.6k43 gold badges102 silver badges129 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Shankar Narayana Damodaran Over a year ago

Did you add the mysql_error() to your $result variable as shown ?

Gaston Velarde Over a year ago

Yup "$result=mysql_query($sql) or die(mysql_error());"

Shankar Narayana Damodaran Over a year ago

and did you get any error messages ? If not have you enabled error_reporting ?

Gumbo Over a year ago

How should removing the parenthesis make any difference?

Community · Accepted Answer · 2017-05-23 11:57:07Z

1

You forgot to add (dot) symbol.

$result = mysql_query("UPDATE balance SET Balance='".$NewBalance."' WHERE ID_No='".$ID_No."';");

This approach is bad and you might want to read this post to prevent SQL injection.

edited May 23, 2017 at 11:57

CommunityBot

11 silver badge

answered Mar 23, 2014 at 7:16

V Setyawan

866 bronze badges

Collectives™ on Stack Overflow

MySQL Update with variables in PHP

2 Answers 2

4 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related