How do I update the database values using update statement?

Question

I am trying to update 'company_name', 'company_add', 'price' as primary key 'id' but it shows me a 'something went wrong' message along with an 'undefined id' error. please help me!

<?php
include('data_conn.php');

if(isset($_POST['sub']))
{
    $comname=$_POST['cname'];
    $comadd=$_POST['cadd'];
    $pri=$_POST['price'];

    $query ="UPDATE login SET company_name=$comname,company_add=$comadd,price=$pri WHERE id=$id";
    $result = mysql_query($query);
    echo $result;
    if(!$result)
    {
        echo '<script language="javascript">';
        echo 'alert("something went Wrong...:("); location.href="edit.php"';
        echo '</script>';
    }else{
        echo '<script language="javascript">';
        echo 'alert("successfully updated!!!"); location.href="edit.php"';
        echo '</script>';
    }
}
?>

`language="javascript"`? `mysql_query`? Some really outdated code. — Ultimater, Jul 11 '16 at 06:10
$id is not accepting any id....but i am giving id=1; then it update successfully — Rkboss, Jul 11 '16 at 06:16

score 2 · Accepted Answer · edited May 23 '17 at 10:29

Instead of using direct substitution values, you could use below methods to avoid sql injection.

You basically have two options to achieve this:

Using PDO (for any supported database driver):

$stmt = $pdo->prepare('SELECT * FROM employees WHERE name = :name');

$stmt->execute(array('name' => $name));

foreach ($stmt as $row) {
    // do something with $row
}

Using MySQLi (for MySQL):

$stmt = $dbConnection->prepare('SELECT * FROM employees WHERE name = ?');
$stmt->bind_param('s', $name);

$stmt->execute();

$result = $stmt->get_result();
while ($row = $result->fetch_assoc()) {
    // do something with $row
}

Please refer How can I prevent SQL injection in PHP?

score 0 · Answer 2 · answered Jul 11 '16 at 06:09

You have to put the character values in single quotes:

$query ="UPDATE login SET company_name='$comname',company_add='$comadd',price=$pri WHERE id=$id";

Stop using deprecated mysql_* API. Use mysqli_* or PDO with prepared Statements. Atleast use the error function, to get the error message.

How do I update the database values using update statement?

2 Answers2

Linked