Question

This is the code I’m using:

<?php
// Set the MySQL Configuration
$db_host       = "";
$db_user       = "";
$db_password   = "";
$db_name       = "";
$db_table      = "";

// Start Connection
$db_connect        =  mysql_connect ($db_host, $db_user, $db_password);

// Select Database
$db_select        =  mysql_select_db ($db_name, $db_connect);

// Update Values in Database


$query         = "UPDATE $db_table SET

    age  =  age + 1,

    land = '".$_POST['data3']."'

    WHERE name = '".$_POST['data1']."'

    ";


// Execution MySQL query        
$result =  mysql_query($query) or die(mysql_error($db_connect));

//Close MySQL connection
mysql_close($db_connect);

//HTTP Response
echo " your age: age";

?>

I want to echo the value of the $age variable, but instead I always get the word “age.” For example, the code should echo your age: 5 but instead it outputs your age: age

Answer 1

First, you’ll need to run a SELECT query to retrieve the updated value of age. The query should look something like this:

"SELECT age FROM db_table_name WHERE name = ?"

Once you’ve obtained the result of that query, with say PDO::fetch (see my note below about PDO) and set it to the variable $age, you can output it with an echo statement:

echo "Your age: $age";

Also, please don’t use mysql_* functions for new code. They are no longer maintained and the community has begun the deprecation process (see the red box). Instead, you should learn about prepared statements and use either PDO or MySQLi. If you can’t decide which, this article will help you. If you care to learn, this is a good PDO tutorial.

The reason I’m not giving you the exact code for this is because it shouldn’t be done with the mysql_* functions at all. Creating an SQL query with data directly from $_POST like this is extremely dangerous code to use and an incredibly bad idea all around. Never do this. You open yourself up to numerous SQL injection attacks. Even using mysql_real_escape_string is not enough. You should be using prepared statements.

UPDATE: Here is a simple example that’s close to what you’re asking, but using PDO and prepared statements. This is by no means a comprehensive example, since there are several ways to alter it that will still work (e.g. prepared statements allow you to execute multiple statements on the server in one statement), and I don’t have a working server at the moment to test to make sure it’s exactly what you need, but I hope it gets the point of across.

<?php

// Create the database connection
$db = new PDO('mysql:host=localhost;dbname=testdb;charset=UTF-8', 'username', 'password');

// Set PDO/MySQL to use real prepared statements instead of emulating them
$db->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);

// The UPDATE query we're going to use
$update_query = "UPDATE `db_table_name` SET age = age + 1, land = :land WHERE name = :name";

// Prepare the query
$stmt = $db->prepare($update_query);

// Bind variables to the named parameters in the query with their values from $_POST
$land = $_POST['data3'];
$name = $_POST['data1']
$stmt->bindParam(':land', $land);
$stmt->bindParam(':name', $name);

// Execute the statement on the server
$stmt->execute();

// The SELECT query we're going to use
$select_query = "SELECT age FROM `db_table_name` WHERE name = :name";

// Again, prepare the query
$stmt_select = $db->prepare($select_query);

// Bind the paramters (in this case only one) to the new statement
// $name is already set from before, so there is no need to set it again
$stmt_select->bindParam(":name", $name);

$stmt_select->execute();

/*
 * With no arguments, PDO::fetchColumn() returns the first column
 * in the current row of the result set. Otherwise, fetchColumn()
 * takes a 0-indexed number of the column you wish to retrieve
 * from the row.
*/
$age = $stmt_select->fetchColumn();

echo("Your age: $age");
?>

All of this information came directly from the PHP documentation on prepared statements and PDO::fetchColumn().