MySQL / PHP - Cannot update database entries

Question

At the moment I'm trying to make a mini blog/cms type of thing for myself to test my skills and hopefully learn a thing or two with PHP.

So I've got a form that has a text field inside it. When it's submitted it should run the following query, however I get the following error...

Resource id #4 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'cms, description = hello world, maintenance = off, regsi' at line 1

Here is the code around that area...

mysql_query("UPDATE settings SET name = " . $siteName . ", description = " . $siteDesc . ", maintenance = " . $siteMode . " [...] ") or die($settings . "<br/>" . mysql_error());

I've shortened it using "[...]" as it follows the same style (ie. "test1 = $test1, test2 = $test2" etc...).

Any help please? Thanks!

Answer 1

You don't actually need to be closing and reopening the string with the . (concatenation) operator

The php string parser will interpolate variables into the string.

So you can do it like this:

mysqli_query("UPDATE settings SET name = '$siteName', description = ...";

The single quotes tell mysql to treat the variables as string literals instead of column names.

What you should also be doing (if not already) is escaping your user input variables see How can I prevent SQL injection in PHP?

And what you should not be doing is using mysql*_ functions as they're depreciated. see the big red box here use mysqli*_ instead