Question

This code is supposed to update the database record for the given book. There is form that passes this function the rquired data and there are no errors in that form but I fear that I have formated my query to UPDATE MySQL incorrectly. Can someone verify this for me? I seem to always have trouble remember the formatting of a MySQL query string. If anyone has tips on how to remember it quickly without looking at documentation that would be greatly appreciated.

function saveBook ($ID, $Title, $Author, $Type, $Section, $AvailableMaterial)
{
    $query = "UPDATE Publications SET Title = '$Title', Author = '$Author', Section = '$Section', Type = '$Type', AvailableMaterial = '$AvailableMaterial' WHERE ID = '$ID'";
$result = mysql_query($query);
    if (!$result)
    {
    die('Query Failed: ' . mysql_error());
    }
    return HEADER ("LOCATION: /lightBox/close.php");
}

Answer 1

No this code is not correct.

 $query = "UPDATE Publications SET `Title` = '".$Title."', `Author` = '".$Author."', `Section` = '".$Section."', `Type` = '".$Type."', `AvailableMaterial` = '".$AvailableMaterial."' WHERE `ID` = '".(int)$ID."'";

is better. type is a reserved key in mysql, so you need backtics.

And I assume you escape all your data before sending it to “savebook”