CODEWITHSUNDEEP
phpsql
Solorzano Jose
Solorzano Jose

Reputation: 632

Unknown column happens on select but not update?

$sql = "SELECT * FROM `productos` WHERE `serial` = ".$_POST['articulo']."";

The query above doesnt work, it says "Unknown column 'KM3M34KL43M' in 'where clause'" This is so strange! because im telling it the column is called serial...

 $sql = "UPDATE `productos` SET `cantidad` = {'".$cantidad."'} WHERE `serial` = ".$_POST['articulo']."";

This query, however, works just fine, and the where clause is the same

Upvotes: 0

Views: 28

Answers (2)

Barranka
Barranka

Reputation: 21067

Might be just a typo, but I think you have to enclose in single quotes the value returned by POST:

$sql = "SELECT * FROM `productos` WHERE `serial` = '".$_POST['articulo']."'";

Upvotes: 0

Marcin Orlowski
Marcin Orlowski

Reputation: 75645

If serial of text type, then you have to quote the value, so instead of 

$sql = "SELECT * FROM `productos` WHERE `serial` = ".$_POST['articulo']."";

it should be:

$sql = "SELECT * FROM `productos` WHERE `serial` = '".$_POST['articulo']."'";

HOWEVER, your code is vulnerable to SQLInjection, so you have to escapoe the value as passing user provided data without that is wrong. See methods like mysqli_real_escape_string() and use it on your $_POST['articulo'] while building the query.

Upvotes: 1

Related Questions