Question

I tried converting my old php sql script into PDO but it keeps setting the users points to 0 instead of adding +15

Heres the original

<?php

session_start();
$db = mysqli_connect("host", "username", "password", "dbname"); 
$username = $_SESSION['username'];
mysqli_query($db, "UPDATE login_users SET Points=Points+15 WHERE username='$username'");


?>

Here is the PDO statement I tried to create. Is my syntax wrong ?

<?php

session_start();
$db = new PDO('mysql:host;dbname=dbname;charset=UTF-8', 'username', 'password');
$username = $_SESSION['username'];
$Points = $db->exec("UPDATE login_users SET Points='Points+15' WHERE username='$username'");


?>

Answer 1

‘Points+15’ is a literal. You need it without the single quotes.

UPDATE login_users SET Points=Points+15 WHERE username='$username'

Better yet, take advantage of parametrization:

$Points = $db->prepare("UPDATE login_users SET Points=Points+15 WHERE username=?");
$Points->execute(array($username))