Question

Given the following UPDATE query in my controller

$connection = yii::app()->db;
$sql = "UPDATE list SET Status = 'R' WHERE ".$_POST['ListId']."=".$_POST['RListId'];
$command=$connection->createCommand($sql);
$command->execute();

This is changing every record to Status = 'R' not just the one with the matching parameters. $_POST['ListId'] and $_POST['RListId'] are exactly what I need and I have verified them though var_dump in the controller.

What is wrong with my query?

Answer 1

You have no field name in your where clause. So it could be where you have 1=1 which evaluates to true for every record.

As a guess I think you want something like this

Yii::app()->db
    ->createCommand("UPDATE list SET Status = 'R' WHERE ListId=:ListId OR RListID=:RListID")
    ->bindValues(array(':ListId' => $_POST['ListId'], ':RListID' => $_POST['RListId']))
    ->execute();