2 replies to this topic

[iamchristill]

Hi,

Can anybody see what im doing wrong here? Im trying to update a record in mysql db and it works fine until I add the variable $soldtrader. Here is the code.

<?php


$con = mysql_connect("localhost","root","root");

if (!$con)

  {

  die('Could not connect: ' . mysql_error());

  }

mysql_select_db("mssystems1", $con);


$id = $_POST['id'];

$name = $_POST['name'];

$score = $_POST['score'];

$pricesold = $_POST['pricesold'];

$soldtrader = $_POST['traderid'];



mysql_query("UPDATE vehiclerequests SET collected='0', sold='1', soldfor= $pricesold tradersoldto= $soldtrader WHERE id = $id ");


mysql_close($con);

?>

Thanks

Chris

[Orjan]

I'd advice you to put ' around all data in the query.

[SoN9ne]

Orjan said:

I'd advice you to put ' around all data in the query.

Asides from obvious inject issues, this should resolve your issue.
Use mysql_real_escape_string to prepare your data for insertion. I would also recommend you filter the data before you escape it. Also, you should put some fail-safes in the code as well. What happens if there is no id or if all of the values are empty? Remember, you cannot trust your user's input.