向我发送错误的SQL语法

Question

I have a Mysql Database named user. Here is a picture:

I want to change the Username of the user "dodlo.rg" programmatically.

Actually, I have the PHP-Version 7.1. And this is a part of my PHPCode:

EDITED CODE:

$newName= $_POST["changeT"];  
$userId = $_POST["userId"];

      $db = mysqli_connect("trolö", "trolö", "trolö123", "trolö")
      $sql = "UPDATE user SET username = '$newName' WHERE user_id = '$userId'";
      $query = mysqli_query($db, $sql);
      $response["successU"] = true;

But I get the Error: "You gave an Error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'SELECT * FROM user' at line 1"

Thanks in advance.

Answer 1

You have to convert this query into two parts

$sql1 = "UPDATE user SET username = $newName WHERE username = 'dodlo.rg'";
$sql2 = "SELECT * FROM user";

Answer 2

The problem lies in 2 parts. Firstly, since this column is a varchar field it needs to be inside quotes else it produces an sql error. Secondly the SELECT statement just after is not valid, but i guess it was a copy/paste error.

Therefore your working code should be:

$newName= $_POST["changeT"];  

  $db = mysqli_connect("trolö", "trolö", "trolö123", "trolö")
  $sql = "UPDATE user SET username = '".addslashes($newName)."' WHERE username = 'dodlo.rg'";
  $query = mysqli_query($db, $sql);
  $response["successU"] = true;

Also, please consider using your primary keys on your where statement rather a varchar field, as it'll improve speed when more complex queries. (eg. where user_id = 35 instead of where username = 'dodlo.rg' ).

Lastly, but quite important this code might be vulnerable to sql injections. You need to use prepared statements.