Question

When i do a query it says:

"Parse error: syntax error, unexpected T_VARIABLE in *****/postchange.php on line 125"

My query is:

PHP:

$id = $_GET['id'];
if($id > 1){
  mysql_query("UPDATE `post` SET userid = 16 WHERE postid = "$id)
  or die(mysql_error());
  echo '...Done';
} else {
  echo 'Invalid post.';
}

any ideas?

Answer 1

You’re missing a . between your string and variable. It’s necessary to concatenate into a single string. It should be:

mysql_query("UPDATE `post` SET userid = 16 WHERE postid = " . $id)
or die(mysql_error());

Although really you should be using mysqli_* or PDOs.

Additionally, your query is extremely susceptible to SQL Injections. You need to sanitize the $_GET[‘p’] before entering it into the database. At the very least, use mysql_real_escape_string().