Question

What is wrong with this script? I cannot figure out the issue!

function editAccount() {
  $id = $_POST['id'];   
  $rep = $_POST['rep'];
  $lastchange = date('mdY');
  $account = $_POST['account'];
  $areacode = $_POST['areacode'];
  $number = $_POST['number'];
  $address1 = $_POST['address1'];
  $address2 = $_POST['address2'];
  $city = $_POST['city'];
  $state = $_POST['state'];
  $zip = $_POST['zip'];
  $country = $_POST['country'];
  $fax = $_POST['fax'];
  $descmaker1 = $_POST['descmaker1'];
  $descmaker2 = $_POST['descmaker2'];
  $title = $_POST['title'];
  $email = $_POST['email'];
  $cvendor = $_POST['cvendor'];
  $cequipment = $_POST['cequipment'];
  $leaseexp1 = $_POST['leaseexp1'];
  $leaseexp2 = $_POST['leaseexp2'];
  $leaseexp3 = $_POST['leaseexp3'];
  $leaseexp4 = $_POST['leaseexp4'];
  $leaseexp5 = $_POST['leaseexp5'];
  $leaseexp6 = $_POST['leaseexp6'];
  $volume = $_POST['volume'];
  $notes = $_POST['notes'];     

  mysql_db_query("UPDATE accounts 
                     SET (lastchange = '$lastchange',
                             account = '$account',
                            areacode = '$areacode',
                              number = '$number',
                            address1 = '$address1',
                            address2 = '$address2',
                                city = '$city',
                               state = '$state',
                                 zip = '$zip',
                                 fax = '$fax',
                          descmaker1 = '$descmaker1',
                          descmaker2 = '$descmaker2',
                               title = '$title',
                               email = '$email',
                             cvendor = '$cvendor',
                          cequipment = '$cequipment',
                           leaseexp1 = '$leaseexp1',
                           leaseexp2 = '$leaseexp2',
                           leaseexp3 = '$leaseexp3',
                           leaseexp4 = '$leaseexp4',
                           leaseexp5 = '$leaseexp5',
                           leaseexp6 = '$leaseexp6',
                              volume = '$volume',
                               notes = '$notes')            
         WHERE id = $id");
}

Error:

Warning: Wrong parameter count for mysql_db_query() in /home/content/53/7311353/html/cca/accounts/include/processAct.php on line 83

Line is: WHERE id=$id");

Answer 1

The problem here, is you’re calling the wrong function. mysql_db_query should be mysql_query.

You also don’t need the parenthesis after SET.

Regarding sql injection, I suggest you escape all $_POST variables with mysql_real_escape_string.