Question

I’ve written a function which updates the mysql database row with some new column data.
Here is the function:

function sql($set,$data){
    $sql = mysql_query("UPDATE members SET '".$set."' = '".$data."' WHERE login = '".$_SESSION['login']."'");
    if($sql){
        echo 'Profile updated.';
    }
    else{
        echo 'Could not update profile. Please try again later.';
    }
}

And here is a fragment from the program which is supposed to utilise the function:

$array = array("$password", "$email", "$age");
                        if($array[0] != 0){
                            sql("password",$password);
                        }
                        if($array[1] != 0){
                            sql("email",$email);
                        }
                        if($array[2] != 0){
                            sql("age",$age);
                        }

It doesn’t write the values to the database. What’s wrong? Maybe it’s the quotation of the variables in the function?

Answer 1

Remove the single quote on the SET :

function sql($set,$data){
    $sql = mysql_query("UPDATE members SET ".$set." = '".$data."' WHERE login = '".$_SESSION['login']."'");
    if($sql){
        echo 'Profile updated.';
    }
    else{
        echo 'Could not update profile. Please try again later.';
    }
}

Column names don’t dont need to be quoted

Working example here -> http://www.sqlize.com/c34I44c37r