Mysql insert just part of string and don't report error

Question

I probably have some injection error in my code, but I don't know where this is happening.

$name = 'Toshiba LED TV 32" 32W2333D HD Ready';

$query = "UPDATE `tv`
         SET `title` = '" . $this->mysqli->real_escape_string($name). "'
         WHERE `id` = '" . $id . "'";

$prep = $this->mysqli->prepare($query);
$prep->execute();

Instead to get in field title:

Toshiba LED TV 32" 32W2333D HD

I get:

Toshiba LED TV 32"

and the where is probably wrong too. WHERE '42'? perhaps it should be WHERE id = '42' or something. Since you're using mysqli, why are you manually escaping anyways? Why not use a prepared statement and placeholders? — Marc B
– Marc B, Commented Feb 18, 2015 at 15:55
@MarcB Probably? - Nah; is. Definitely missing an equal sign. OP's probably not showing us actual used code. Edit: It's been changed. — Funk Forty Niner
– Funk Forty Niner, Commented Feb 18, 2015 at 15:57
@Fred-ii- i added that, sorry, there is no id field just wanted to give sample. — Ivan Vulović
– Ivan Vulović, Commented Feb 18, 2015 at 15:58
if you pass the $name as Toshiba LED TV 32 32W2333D HD , will you still having that issue? — peterpeterson
– peterpeterson, Commented Feb 18, 2015 at 15:58

lmarcelocc · Accepted Answer · 2015-02-18 16:23:09Z

2

Have you tried to use bind parameters? Like:

$query = $mysqli->prepare("UPDATE tv SET title = ? WHERE id = ?");
$statement = $mysqli->prepare($query);

$results =  $statement->bind_param($product_title, $find_id);

edited Feb 18, 2015 at 16:23

answered Feb 18, 2015 at 16:07

lmarcelocc

1,37112 silver badges21 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Mysql insert just part of string and don't report error

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related