Question

I have very specific question, I cannot find a problem. I try update some text, and I get an error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘=
Easter in Corfu is considered to be the most magnificent celebration in Gree’ at line 1

My code:

$arr = explode("|", $id, 2);
$id = $arr[0];
$part = $arr[1];                                                // in which part of a splited paragraph currently we are
$row = mysql_fetch_array(mysql_query("SELECT * FROM paragraph WHERE id=$id")) or die(mysql_error());    
$search = 'insertphotos';                                       // the string to search for     
$string = $row['text_content'];                                 // the string to search
$repetition = substr_count($string, $search);                   // how many insertphotos exist in paragraph
if ($repetition > $part){   
    if ($part > 1)
        $offset = $part - 1;                                    // how many times to search for word insertphotos
    else
        $offset = $part;
    $start = strposOffset($search, $string, $offset) + 13;      // find position of '$offset' occurance of search string
    $offset++;
    $end = strposOffset($search, $string, $offset) - $start - 1;
    $string = substr_replace($string, $value, $start, $end);
}else if ($repetition == $part){
    $offset = $part;                                        // how many times to search for word insertphotos
    $start = strposOffset($search, $string, $offset) + 13;      // find position of '$offset' occurance of search string
    $string = substr_replace($string, $value, $start, strlen($string)); 
}else
    $string = "<p>".$value."</p>";
//$value = "<p>".$value."</p>";
mysql_query("UPDATE paragraph SET text_content=".$string." WHERE id='$id'") or die(mysql_error());  
//mysql_query("INSERT INTO paragraph (header, text_content, menu_id, sequence) VALUES('<h2>Bella Vista Hotel h2 - Please Change Me</h2>', $string, '15', '2')") or die(mysql_error());
mysql_close($link);     
//echo "INSERT PHOTOS REPEATS " .$repetition ." ID =".$id ." PART = ".$part ." WE SEARCH, START AT " .$start ." FINISH AT " .$end ." SEARCH FOR OFFSET = " .$offset ." FINAL STRING " .$string;
echo $string;

Every variable works, I tried to echo, there is no any problem. If there is only one insertphotos (or zero) in the text it works. While I have more than one, then I get this error. I don’t have a clue why?

Answer 1

Your text string isn’t quoted.

mysql_query("UPDATE paragraph SET text_content='".mysql_real_escape_string($string)."' WHERE id='$id'") or die(mysql_error());

You should also escape your inputs: http://php.net/manual/en/function.mysql-real-escape-string.php