Question

I’m currently attempting to update existing records within a MySQL database. Prior to the updated information being sent to the database, it is placed in an array, run through a validation function before using the implode function to enable me to insert the array into the database. This works fine when adding new users, but I am having difficulty using the imploded array for a UPDATE query.

Can I specify individual strings from the imploded array, so that I can SET username to the username string contained within the original array?

I currently have something like this which is giving me an SQL error – however, I never expected this to work as the SQL syntax is wrong.

public function editUser($array, $userID) {
    $edited = 'User Ammended';
    $array['password'] = $this->hashPassword($array['password']);
    $implodeArray = '"'.implode( '","', $array ).'"';
    $sql = ('UPDATE user (email, password, firstName, lastName, officeID, departmentID, managerID, roleID, username) WHERE userID=$userID VALUES ('.$implodeArray.')');
    mysql_query($sql,$this->_db) or die(mysql_error());
    mysql_close();
}

Answer 1

This should work:

public function editUser($array, $userID) {
        $edited = 'User Ammended';
        $array['password'] = $this->hashPassword($array['password']);
        /*Assuming array keys are = to database fileds*/
        if (count($array) > 0) {
            foreach ($array as $key => $value) {

                $value = mysql_real_escape_string($value); // this is dedicated to @Jon
                $value = "'$value'";
                $updates[] = "$key = $value";
            }
        }
        $implodeArray = implode(', ', $updates);
        $sql = ("UPDATE user WHERE userID=$userID SET $implodeArray");
        mysql_query($sql,$this->_db) or die(mysql_error());
        mysql_close();
}