CODEWITHSUNDEEP
phpcssmysql
Jamie
Jamie

Reputation: 1

check the manual that corresponds to your MariaDB server version for the right syntax to use near 'WHERE id=' \r\n

I am new to php and cannot get this! I'm attempting to edit data on an edit page which will be stored through an update page onto mySQL.

<?php

include("secure/connect.php");


$newtitle = mysqli_real_escape_string($conn, ($_POST['title']));
$newinfo = mysqli_real_escape_string($conn,($_POST['info']));
$newprice = mysqli_real_escape_string($conn,($_POST['price']));
$newmenu_img = mysqli_real_escape_string($conn,($_POST['menu_img']));



$id = mysqli_real_escape_string($conn, ($_POST['rowid']));



//setup a SQL query
$query= "UPDATE  cocktails SET title='$newtitle', info='$newinfo',       price='$newprice', menu_img='$newmenu_img', WHERE id='$id'";

$result = mysqli_query($conn, $query) or die(mysqli_error($conn));


mysqli_close($conn);
?>

I keep getting the error: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'WHERE id=' \r\nNotice: Undefined variable: iddata in /var/www/vh' at line 1

Upvotes: 0

Views: 1269

Answers (1)

svgrafov
svgrafov

Reputation: 2014

If your parameters are OK, removing comma(,) in this line 

UPDATE cocktails SET title='$newtitle', info='$newinfo', price='$newprice', menu_img='$newmenu_img', WHERE id='$id'

before WHERE will do the job. Note that MariaDB will start code in error message from exactly the part that gives error - in your case it tries to parse WHERE part as continuation of list of parameters.

Your code is also vulnerable to SQL code injection, so check out this answer before sending your code into production server.

Upvotes: 1

Related Questions