Question

My code is

$user_query = '
     UPDATE  
          users  
     SET  
          `password`="$password",  
          `email`="$email", 
          `position`="$position", 
     WHERE  
          `username`=".$uname."';
$user_result = mysql_query($user_query, $connection);
confirm_query($user_result);

When I run this query it gives me an error:

Database query failed: You have an error in your SQL syntax;
check the manual that corresponds to your MySQL server version for the right syntax to use near ‘WHERE username=”.$uname.”‘ at line 7

Can any body help me resolve this error?

Answer 1

Your query is in single quotes, so the variables aren’t parsed. As you can see in error, the string is literally

`username`=".$uname."

You need to either use double quotes around the enitre thing, to parse variables correctly.

$user_query = "
 UPDATE  
      users  
 SET  
      `password`='$password',  
      `email`='$email', 
      `position`='$position'
 WHERE  
      `username`='$uname'";

Or correctly use the string concatanation operator, ..

$user_query = '
 UPDATE  
      users  
 SET  
      `password`="'.$password.'",  
      `email`="'.$email.'", 
      `position`="'.$position.'"
 WHERE  
      `username`="'.$uname.'"';

As others have noted, there’s also an extra , after postion="$position".