Query failed. You have an error in your SQL syntax when updating

Question

So work on a school project, and I'm trying to create a way to update an existing product on a page, only it's price and description that I want to update. I just can't work out where I'm going wrong. Thanks in advance.

Now on the update.php page I have created a function so that it dynamically display products in a option, selection form.

This is the error,

query failedYou have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE product = SAMSUNG 60" FULL HD QUAD CORE 3D SMART LCD LED TV ' at line 1.

This is my update function

function updateData() {

    if(isset($_POST['submit'])) {
    global $db;    

   $itemName = $_POST['product'];
   $itemprice =  $_POST['itemPrice']; 
    $itemDescription = $_POST['itemDescription'];        


   $query = "UPDATE products SET ";
  $query .= " price = `$itemprice`, ";
   $query .= " description = `$itemDescription`, ";     
  $query .= " WHERE product = `$itemName` ";

   $result = mysqli_query($db, $query);

  if(!$result) {

    die("query failed" . mysqli_error($db));  
   } else {

      echo "Your details have been updated";
       }

     }

   }

and here is my update.php page

        require_once ("Includes/simplecms-config.php"); 
    require_once ("Includes/connectDB.php");
    include("Includes/header.php");  
    include("functionsphp.php");

    confirm_is_admin();
    updateData();


    // max file size for the html upload form
    $max_file_size = 50 * 1024 * 1024; // size in bytes

    // directory that will recieve the uploaded file
    $dir = 'Images/products/';

?>

<div id="container">
    <div id="admin">
        <h1>update  Product</h1>
        <form id="product_form" class="dialogform"
    action="editProduct.php" method="post" enctype="multipart/form-
   data">
            <div class="form_description">
                <p>Fill in the details below to update details to the
       catalog item.</p>

                <select class="description" name="product" id="">

                <?php ShowProduct();?>  

            </select>   
            </div>

      <div id="container">
    <div id="admin">
        <h1>update Product</h1>
        <form id="product_form" class="dialogform" 
      action="addProduct.php" method="post" enctype="multipart/form-
      data">
            <div class="form_description">
                <p>Fill in the details below to update the product to




        the catalog.</p>
            </div>

            <label class="description" for="itemPrice">Price</label>
            <div>
                <input id="itemPrice" name="itemPrice" type="text"
         maxlength="255" />
            </div>

            <label class="description" 
      for="itemDescription">Description</label>
            <div>
                <textarea style="width: 350px; height: 108px;"   
     id="itemDescription" name="itemDescription"></textarea>
            </div>


            <input id="submit_button" class="button_text" 
           type="submit" name="submit" value="Submit" />
        </form>
       </div>
   </div>

Answer 1

$query = "
UPDATE products 
   SET price = $itemprice
     , description = '$itemDescription'
 WHERE product = '$itemName'
";

Now see about prepared and bound queries. And as has been mentioned, the where clause should reference the primary key