MySQL Update with variables in PHP

Question

mysql_connect('localhost', 'root', '')
        or die(mysql_error());
mysql_select_db('shuttle_service_system') 
or die(mysql_error());

$ID_No=$_POST['ID_No'];
$CurrentBalance = $_POST['CurrentBalance'];
$AddedAmount = $_POST['AddedAmount'];
$NewBalance = $CurrentBalance + $AddedAmount;

$sql = ("UPDATE balance
        SET Balance= '$NewBalance' 
        WHERE ID_No= '$ID_No' ");
$result=mysql_query($sql);

if($result){
        echo"Transaction successful!";
} else {
        echo "&nbsp Error";
}

Hi guys I'm trying to update my certain values in my database with the use of variables. It updates when I use brute force and not variables. I know my variables are working because I printed them before queuing the update.

Your code is vulnerable to SQL injections. You should read on [how to prevent them in PHP](http://stackoverflow.com/q/60174/53114). — Gumbo, Mar 23 '14 at 07:22

score 1 · Accepted Answer · answered Mar 23 '14 at 06:53

1

Remove the paranthesis outside this UPDATE Statement

$sql = ("UPDATE balance
        SET Balance= '$NewBalance' 
        WHERE ID_No= '$ID_No' ");

It should be

$sql = "UPDATE balance
        SET Balance= '$NewBalance' 
        WHERE ID_No= '$ID_No' ";

Also, add this mysql_error() to read the exact error when your query fails.

$result=mysql_query($sql) or die(mysql_error());

This(mysql_*) extension is deprecated as of PHP 5.5.0, and will be removed in the future. Instead, the MySQLi or PDO_MySQL extension should be used. Switching to PreparedStatements is even more better to ward off SQL Injection attacks !

answered Mar 23 '14 at 06:53

Shankar Narayana Damodaran

68,075
43
96
126

Did you add the `mysql_error()` to your `$result` variable as shown ? – Shankar Narayana Damodaran Mar 23 '14 at 07:04
1

Yup "$result=mysql_query($sql) or die(mysql_error());" – Gaston Velarde Mar 23 '14 at 07:07
and did you get any error messages ? If not have you enabled [`error_reporting`](http://stackoverflow.com/a/6575502/1003917) ? – Shankar Narayana Damodaran Mar 23 '14 at 07:09
How should removing the parenthesis make any difference? – Gumbo Mar 23 '14 at 07:24

score 1 · Answer 2 · edited May 23 '17 at 11:57

1

You forgot to add (dot) symbol.

$result = mysql_query("UPDATE balance SET Balance='".$NewBalance."' WHERE ID_No='".$ID_No."';");

This approach is bad and you might want to read this post to prevent SQL injection.

edited May 23 '17 at 11:57

Community

1
1

answered Mar 23 '14 at 07:16

V Setyawan

76
6

MySQL Update with variables in PHP

2 Answers2