Updating a database using PHP

Question

<?php

if (isset($_GET['firstname'])){
    $fname = $_GET['firstname'];
}

mysql_query("UPDATE student SET firstname = $fname WHERE studentID = $id");

?>

I have a form that will update my database. At the bottom of the form there is a update button. When I use this code it does not work.

I can put in a "tom in where it says $fname in my mysql_query and it will update.

I can also echo out the $fname variable and it will echo out what is in the form correctly.

But I cannot get the database to take the $fname.

Any suggestions would be great, thanks.

Answer 1

You forgot the quotes around the name:

mysql_query("UPDATE student SET firstname = '$fname' WHERE studentID = $id");

BTW your code is vurnerable to SQL injections. Please fix that problem. See best-way-to-prevent-sql-injection-in-php

Answer 2

You are missing single quotes around $fname and $id (if its a string),

mysql_query("UPDATE student SET firstname = '$fname' WHERE studentID = '$id'");

Note: Mysql_* extensions are deprecated, and are open to SQL injection. So, avoid using them. Use PDO or Mysqli_* instead.