如何使用update语句更新数据库值？

Question

I am trying to update 'company_name', 'company_add', 'price' as primary key 'id' but it shows me a 'something went wrong' message along with an 'undefined id' error. please help me!

<?php
include('data_conn.php');

if(isset($_POST['sub']))
{
    $comname=$_POST['cname'];
    $comadd=$_POST['cadd'];
    $pri=$_POST['price'];

    $query ="UPDATE login SET company_name=$comname,company_add=$comadd,price=$pri WHERE id=$id";
    $result = mysql_query($query);
    echo $result;
    if(!$result)
    {
        echo '<script language="javascript">';
        echo 'alert("something went Wrong...:("); location.href="edit.php"';
        echo '</script>';
    }else{
        echo '<script language="javascript">';
        echo 'alert("successfully updated!!!"); location.href="edit.php"';
        echo '</script>';
    }
}
?>

Answer 1

Instead of using direct substitution values, you could use below methods to avoid sql injection.

You basically have two options to achieve this:

1. Using PDO (for any supported database driver):

    $stmt = $pdo->prepare('SELECT * FROM employees WHERE name = :name'); \n\n$stmt->execute(array('name' => $name)); \n\nforeach ($stmt as $row) { \n    // do something with $row \n}  

2. Using MySQLi (for MySQL):

    $stmt = $dbConnection->prepare('SELECT * FROM employees WHERE name = ?'); \n$stmt->bind_param('s', $name); \n\n$stmt->execute(); \n\n$result = $stmt->get_result(); \nwhile ($row = $result->fetch_assoc()) { \n    // do something with $row \n}  

Please refer How can I prevent SQL injection in PHP?

Answer 2

You have to put the character values in single quotes:

$query ="UPDATE login SET company_name='$comname',company_add='$comadd',price=$pri WHERE id=$id";

Stop using deprecated mysql_* API. Use mysqli_* or PDO with prepared Statements. Atleast use the error function, to get the error message.