Question

I have a table defined like this:

create table users (
  id int(10),
  age int(3),
  name varchar (50)
)

I want to use a query to update just age, which is an integer, that comes from an html form.

When it arrives to the method that updates it, it comes as a string, so I change it to integer with PHP and try to update the table, but it doesn’t work

$age = intval($age);
$q2 = "UPDATE users SET age='$age'  where username like '$username';";
mysql_query($q2,$con);

Answer 1

No need to cast your $age string to an integer.

More importantly, use mysql_real_escape_string() to protect against SQL injection.

$q2 = "UPDATE users SET age = " . mysql_real_escape_string($age, $con)
    . " WHERE name = '" . mysql_real_escape_string($username, $con) . "'";
mysql_query($q2, $con);