PHP+mySQL - won't update text field from PHP, but will update from adminer with same query

Question

I have this php script:

$query = "UPDATE event_rsvp SET event_note = '" . $_POST[note] . "', event_rsvp_type_id = '" . $_POST[rsvpId] . "' WHERE user_id = '" . $_POST[userId] . "' AND event_id = '" . $_POST[eventId] . "'";   
$result = $mysqli->$query;
echo $query;

that echo gives me this:

UPDATE event_rsvp SET event_note = 'test', 
       event_rsvp_type_id = '4' 
WHERE user_id = '1' AND event_id = '1'

Problem is that only the event_rsvp_type_id is updated in database, event_note isn't. However, if I copy this echo-ed query and paste it directly into adminer or phpmyadmin, it works fine and updates the note as expected.

Any help? Thanks!

I don't think that code will work at all. What is $mysqli->$query supposed to do? — Chris
– Chris, Commented Aug 9, 2017 at 20:54
Little Bobby says you are at risk for SQL Injection Attacks. Learn about Prepared Statements for MySQLi. Even escaping the string is not safe! I recommend PDO, which I wrote a function for to make it extremely easy, very clean, and way more secure than using non-parameterized queries. — GrumpyCrouton
– GrumpyCrouton, Commented Aug 9, 2017 at 20:55
Well it certainly works in different scenarios. $mysqli = new mysqli($dbHost, $dbUsername, $dbPassword, $dbName); mysqli_set_charset($mysqli,"utf8"); — orishi
– orishi, Commented Aug 9, 2017 at 20:56
@user235937, but $query is a string. You can't do $mysqli->"SELECT * FROM foo", and you can't do $mysqli->$query either. — Chris
– Chris, Commented Aug 9, 2017 at 20:58
Oh, right... thanks a lot, I kind of didn't notice that after 16 hours in front of PC... solved, working. — orishi
– orishi, Commented Aug 9, 2017 at 21:01

GrumpyCrouton · Accepted Answer · 2017-08-09 20:59:52Z

1

Try the following code:

$query = $mysqli->prepare("UPDATE event_rsvp SET `event_note`=?, `event_rsvp_type_id`=? WHERE `user_id`=? AND `event_id`=?");
$query->bind_param("siii", $_POST['note'], $_POST['rsvpId'], $_POST['userId'], $_POST['eventId']);
$query->execute();

Your real problem is that you were missing the singlequotes on your variables, and also, $mysqli->$query doesn't make any sense, the $query part isn't a variable, it should just be query. I converted your code to use prepared statements as well, hopefully this will allow you to see how easy they are to use, while giving you way more security.

answered Aug 9, 2017 at 20:59

GrumpyCrouton

8,6367 gold badges37 silver badges81 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

PHP+mySQL - won't update text field from PHP, but will update from adminer with same query

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related