Question

For some reason this SQL statement is not working. Can anyone tell me why? (This is a Codeigniter site, if that matters)

Here is my Model (where my error is pointing me to)

public function edit_profile($ID, $field, $new_info)
{
    $sql = "UPDATE users SET ?=? WHERE id=?";
    $query = $this->db->query($sql, array($field, $new_info, $ID)); // <<<< LINE 42
    return $query;
}

And this is the error I’m getting

Error Number: 1064
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''first_name'='oooo' WHERE id='151'' at line 1
UPDATE users SET 'first_name'='oooo' WHERE id='151'
Filename: /Applications/MAMP/htdocs/MY_SITE/models/member_model.php
Line Number: 42

My table is called ‘users’, and I have a ‘first_name’ and ‘id’ column.

Ideas?

EDIT

Just because it seems to come up a bit I want to clarify that the variables I am passing in here have NO QUOTES OR BACKTICKS. They are being added somewhere (and it seems like the ->query method, but I cant imagine that’s true? .. dunno though, cause it’s my first CI project)

Here is the controller that is passing to the model…

public function profileEdit()
{
    $ID = $this->the_user->id;
    $field = $this->input->post('edit_field')
    $field = strstr($field,'_edit', true);
    $new_info = $this->input->post('new_info');

    $this->load->model('Member_model');
    if( $this->Member_model->edit_profile( $ID, $field, $new_info )){
        echo 'success';
    }
    else
    {
        echo 'error';
    }
}

Answer 1

i suggest use like this :

public function edit_profile($ID, $field, $new_info)
{
    $sql = "UPDATE users SET $field =? WHERE id=?"; # UPDATED (remove $this->db->escape())
    $query = $this->db->query($sql, array($new_info, $ID)); // <<<< LINE 42
    return $query;
}

if $field is not secured you can use escape functions .
EDIT :
$this->db->escape() will add quotes around variable so you will get an error again .