PHP MySQL - INSERT 和 ON DUPLIATE KEY UPDATE 与 WHERE？

Question

I want to be able for members to add more info (location, story) to their profile and also update their password if needed.

For that I use the following snippet:

$query = mysql_query("
    INSERT INTO 
        members (location, story) 
    VALUES 
        ('$location', '$story') 
    WHERE 
        username='$user' 
    ON DUPLICATE KEY UPDATE 
        hash = '$password', 
        location='$location', 
        story='$story' 
    "); 

This does not work with the "WHERE" part, but if I remove it then the data just gets filled into an empty record, not the user record. How do I properly use the WHERE part in this snippet, so the correct user profile is updated?

I have searched up and down the internet and this website, but not found a single solution, which surprises me as this seems to be a very common question?

Does anyone know how to solve this problem?

Thanks in advance!

Answer 1

First, mysql is deprecated, you should use mysqli .

Second, make sure you escape your values before entering them in queries. mysql_real_escape_string() is a bare minimum.

Third, INSERT / ON DUPLICATE KEY UPDATE does not accept WHERE clause. It's use is for avoid duplicating keys. For a simple user signup or whatever, you could avoid using IDs / auto increment and use username as primary key. But for this you'd need MyISAM or MySQL 5.6+ in order to have fulltext indexing, and in general, this is recommended.

But in this use case, your location and story would be always overwritten. If this is what you want, you can try whatever I've written in the previous paragraph.

Answer 2

You can use a INSERT INTO ... SELECT FROM ... ON DUPLICATE KEY UPDATE construct like

INSERT INTO 
    members (location, story) 
SELECT '$location', '$story'
FROM table_name
WHERE username='$user' 
ON DUPLICATE KEY UPDATE 
    hash = '$password', 
    location='$location', 
    story='$story'

Answer 3

Ok, I was finally able to solve this problem on my own. For anyone who is interested, here is the code:

// if user entered location         
        if (!empty($_POST['location']))
        {
            // if database row empty
            if ($row['location'] == " ")
            {
                mysql_query("INSERT INTO members (location) VALUES ('".$location."') WHERE username='".$user."'");  
            }
            // if database row not empty
            else 
            {
                mysql_query("UPDATE members SET location='".$location."' WHERE username='".$user."'");      
            }
        }
        // if user entered story
        if (!empty($_POST['story']))
        {
            // if database row empty
            if ($row['story'] == " ")
            {
                mysql_query("INSERT INTO members (story) VALUES ('".$story."') WHERE username='".$user."'");    
            }
            // if database row not empty
            else 
            {
                mysql_query("UPDATE members SET story='".$story."' WHERE username='".$user."'");            
            }
        }