0

I want to change data from a database but I keep getting errors and I just cannot find the mistake I made..

Here's the code:

    if(isset($_POST['id'])) {
        if(is_numeric($_POST['id'])) {
            $change = pg_query($db, "SELECT * FROM azubi3 WHERE id = ".$_POST['id']."");
            echo $change;
            if($auto == "") {
                $auto = "false";
            }
            else { $auto = "true"; }
            $change = pg_query($db, "UPDATE azubi3 SET vorname = '".$_POST['prename']."', nachname = '".$_POST['name']."', auto = ".$auto.", auto_id = ".$_POST['auto_id'].", schuh_id = ".$_POST['schuh_id']." WHERE id = ".$_POST['id']."");
        }
        else { echo "ID muss eine Zahl sein!"; }

    }

And that's the error i get:

Warning: pg_query(): Query failed: ERROR: syntax error at or near "," LINE 1: ...achname = 'Mustermüller', auto = false, auto_id = , schuh_id... ^ in /srv/www/htdocs/azubi2/test3.php on line 82
Abhishek Gurjar
  • 7,426
  • 10
  • 37
  • 45
d-hug
  • 55
  • 9
  • first thing, your code is vulnerable against SQL injections. you **MUST** verify and sanitize user input before using it in your query. see http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php?rq=1 – ᴄʀᴏᴢᴇᴛ Jan 13 '17 at 09:50
  • 1
    This has so many SQL Injection options, that I have the feeling, you are trying make a *hack-me-page* – Peon Jan 13 '17 at 09:51
  • `" . $_POST['id'] . "` Replace this with this `' " . $_POST['id'] . " '` – Mr world wide Jan 13 '17 at 09:52
  • Sorry, but i started learning PHP, MYSQL and JavaScript last week. So i'm really new to this and im happy i already got to save data due to a formula into a database. im stuck with the changing for hours now... ^^ – d-hug Jan 13 '17 at 09:54
  • but i thought the '..' are only needed for strings and chars varying? not for integers and serials? – d-hug Jan 13 '17 at 09:58

1 Answers1

1

First thing your sql is vulenrable to injection, you should correct it.

For the sake of your question :

false is a reserved keyword, please use string around it:

 $change = pg_query($db, "UPDATE azubi3 SET vorname = '".$_POST['prename']."', nachname = '".$_POST['name']."', auto = '".$auto."', auto_id = ".$_POST['auto_id'].", schuh_id = ".$_POST['schuh_id']." WHERE id = ".$_POST['id']."");
chandresh_cool
  • 11,753
  • 3
  • 30
  • 45