MySQL UPDATE Query wont work

Question

What is wrong with this script? I cannot figure out the issue!

function editAccount() {
  $id = $_POST['id'];   
  $rep = $_POST['rep'];
  $lastchange = date('mdY');
  $account = $_POST['account'];
  $areacode = $_POST['areacode'];
  $number = $_POST['number'];
  $address1 = $_POST['address1'];
  $address2 = $_POST['address2'];
  $city = $_POST['city'];
  $state = $_POST['state'];
  $zip = $_POST['zip'];
  $country = $_POST['country'];
  $fax = $_POST['fax'];
  $descmaker1 = $_POST['descmaker1'];
  $descmaker2 = $_POST['descmaker2'];
  $title = $_POST['title'];
  $email = $_POST['email'];
  $cvendor = $_POST['cvendor'];
  $cequipment = $_POST['cequipment'];
  $leaseexp1 = $_POST['leaseexp1'];
  $leaseexp2 = $_POST['leaseexp2'];
  $leaseexp3 = $_POST['leaseexp3'];
  $leaseexp4 = $_POST['leaseexp4'];
  $leaseexp5 = $_POST['leaseexp5'];
  $leaseexp6 = $_POST['leaseexp6'];
  $volume = $_POST['volume'];
  $notes = $_POST['notes'];     

  mysql_db_query("UPDATE accounts 
                     SET (lastchange = '$lastchange',
                             account = '$account',
                            areacode = '$areacode',
                              number = '$number',
                            address1 = '$address1',
                            address2 = '$address2',
                                city = '$city',
                               state = '$state',
                                 zip = '$zip',
                                 fax = '$fax',
                          descmaker1 = '$descmaker1',
                          descmaker2 = '$descmaker2',
                               title = '$title',
                               email = '$email',
                             cvendor = '$cvendor',
                          cequipment = '$cequipment',
                           leaseexp1 = '$leaseexp1',
                           leaseexp2 = '$leaseexp2',
                           leaseexp3 = '$leaseexp3',
                           leaseexp4 = '$leaseexp4',
                           leaseexp5 = '$leaseexp5',
                           leaseexp6 = '$leaseexp6',
                              volume = '$volume',
                               notes = '$notes')            
         WHERE id = $id");
}

Error:

Warning: Wrong parameter count for mysql_db_query() in /home/content/53/7311353/html/cca/accounts/include/processAct.php on line 83

Line is: WHERE id=$id");

I hope you realize what a giant security hole this function is — Sam Dufel
– Sam Dufel, Commented May 13, 2011 at 2:37
@Sam Dufel , It probably is.. But Its so nested inside of a bunch of session checks and permission checks I don't see a problem for now.. its just for a small time shop doing simple things. — JD Audi
– JD Audi, Commented May 13, 2011 at 2:39

gen_Eric · Accepted Answer · 2011-05-13 03:12:11Z

2

In the UPDATE command, lose the parenthesis. That's it.

Also, please, beware of SQL Injection.

Update

Here's how the final code should look like:

function editAccount() {
  $id = $_POST['id'];   
  $rep = $_POST['rep'];
  $lastchange = date('mdY');
  $account = $_POST['account'];
  $areacode = $_POST['areacode'];
  $number = $_POST['number'];
  $address1 = $_POST['address1'];
  $address2 = $_POST['address2'];
  $city = $_POST['city'];
  $state = $_POST['state'];
  $zip = $_POST['zip'];
  $country = $_POST['country'];
  $fax = $_POST['fax'];
  $descmaker1 = $_POST['descmaker1'];
  $descmaker2 = $_POST['descmaker2'];
  $title = $_POST['title'];
  $email = $_POST['email'];
  $cvendor = $_POST['cvendor'];
  $cequipment = $_POST['cequipment'];
  $leaseexp1 = $_POST['leaseexp1'];
  $leaseexp2 = $_POST['leaseexp2'];
  $leaseexp3 = $_POST['leaseexp3'];
  $leaseexp4 = $_POST['leaseexp4'];
  $leaseexp5 = $_POST['leaseexp5'];
  $leaseexp6 = $_POST['leaseexp6'];
  $volume = $_POST['volume'];
  $notes = $_POST['notes'];     

  mysql_query("UPDATE accounts 
                     SET  lastchange = '$lastchange',
                             account = '$account',
                            areacode = '$areacode',
                              number = '$number',
                            address1 = '$address1',
                            address2 = '$address2',
                                city = '$city',
                               state = '$state',
                                 zip = '$zip',
                                 fax = '$fax',
                          descmaker1 = '$descmaker1',
                          descmaker2 = '$descmaker2',
                               title = '$title',
                               email = '$email',
                             cvendor = '$cvendor',
                          cequipment = '$cequipment',
                           leaseexp1 = '$leaseexp1',
                           leaseexp2 = '$leaseexp2',
                           leaseexp3 = '$leaseexp3',
                           leaseexp4 = '$leaseexp4',
                           leaseexp5 = '$leaseexp5',
                           leaseexp6 = '$leaseexp6',
                              volume = '$volume',
                               notes = '$notes'         
         WHERE id = $id");
}

edited May 13, 2011 at 3:12

gen_Eric

228k42 gold badges304 silver badges343 bronze badges

answered May 13, 2011 at 2:39

Adriano Carneiro

58.8k12 gold badges94 silver badges123 bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

JD Audi Over a year ago

@Adrian which parenthesis? I tried removing some and it just gave me more errors.

gen_Eric Over a year ago

@JD: The parenthesis after SET.

Adriano Carneiro Over a year ago

Yes, inside the update command. The one right after SET and the the one right after $notes

Adriano Carneiro Over a year ago

Also, @JD, take your time to read about SQL Injection. The way your command is being processed, you can get your DB screwed easily by external attacks.

JD Audi Over a year ago

@Adrian, I know this. Im not too worried about that right now I just want to get it working.

|

gen_Eric · Accepted Answer · 2011-05-13 02:46:54Z

1

The problem here, is you're calling the wrong function. mysql_db_query should be mysql_query.

You also don't need the parenthesis after SET.

Regarding sql injection, I suggest you escape all $_POST variables with mysql_real_escape_string.

answered May 13, 2011 at 2:46

gen_Eric

228k42 gold badges304 silver badges343 bronze badges

Comments

Michael Berkowski · Accepted Answer · 2011-05-13 02:48:50Z

1

According to PHP docs, the deprecated function mysql_db_query() takes at least two parameters. First, is the database name and second is the SQL query. You've only specified the SQL query.

resource mysql_db_query ( string $database , string $query [, resource $link_identifier ] )

So in your case:

mysql_db_query('yourdatabasename', "UPDATE accounts set....");

More common these days is to use mysql_query(), which will make use of the database previously selected with mysql_select_db().

answered May 13, 2011 at 2:48

Michael Berkowski

271k47 gold badges450 silver badges395 bronze badges

Comments

gmhk · Accepted Answer · 2011-05-13 02:47:46Z

Check whether mysql connection is established. Some times that might also be a problem

mysql_query("UPDATE accounts 
                     SET (lastchange = '$lastchange',
                             account = '$account',
                            areacode = '$areacode',
                              number = '$number',
                            address1 = '$address1',
                            address2 = '$address2',
                                city = '$city',
                               state = '$state',
                                 zip = '$zip',
                                 fax = '$fax',
                          descmaker1 = '$descmaker1',
                          descmaker2 = '$descmaker2',
                               title = '$title',
                               email = '$email',
                             cvendor = '$cvendor',
                          cequipment = '$cequipment',
                           leaseexp1 = '$leaseexp1',
                           leaseexp2 = '$leaseexp2',
                           leaseexp3 = '$leaseexp3',
                           leaseexp4 = '$leaseexp4',
                           leaseexp5 = '$leaseexp5',
                           leaseexp6 = '$leaseexp6',
                              volume = '$volume',
                               notes = '$notes')            
         WHERE id = $id")

this is the syntax to update the query, use mysql_query instead of mysql_db_query

Collectives™ on Stack Overflow

MySQL UPDATE Query wont work

4 Answers 4

7 Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

7 Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related