Question

I am trying to let users edit the content that they post. The content is seperated into two sections the title and the text. It also has a category but I don’t want to let them edit that. So here is the code that is suppose to update any changes to the title:

$sql = "UPDATE

topics

SET topic_subject = " . mysql_real_escape_string($_POST[‘topic_subject’]) . "

WHERE

topic_id = " . mysql_real_escape_string($_GET[‘id’]);

The code that updates the content has the same format.
I get the id from the url of the page and once they click submit on the editing page the form calls the page that contains this code. It gives me this error:

An error occurred while inserting your data. Please try again later.

You have an error in your SQL syntax; check the manual that corresponds to your MySQL
server version for the right syntax to use near ‘WHERE topic_id =’ at line 4

I am not an expert in SQL and don’t know what the problem could be. Thanks in advance.

Answer 1

You’re missing single quotes around your string value:

$subject = mysql_real_escape_string($_POST['topic_subject']);
$topic_id = (is_numeric($_GET['id']) ? $_GET['id'] : 'NULL');
$sql = "
    UPDATE topics
    SET topic_subject = '$subject'
    WHERE topic_id = $topic_id
";

My code also assumes topic_id is an int column, so I’m checking if the value is numeric instead of escaping it.