Question

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘s website.

mysql_query("UPDATE Scholarships2 SET Requirements2 = '$requirements2'
    WHERE scholarshipID = '$sID'")
        or die("Insert Error1: ".mysql_error());

I read other Stackoverflow questions/answers on this subject but cannot find the reserved word I am using.

$sID is just an int while, $requirements2 is

$regex = '/<h4>Requirements<\/h4>([\n\n\n]|.)*?<\/table>/';
preg_match_all($regex,$data,$match);
$requirements2 = $match[0][0];

Answer 1

for the right syntax to use near ‘s website

This means it’s complaining about the bit of your query that is 's website. “Where is that bit in your query?”, I hear you ask.

Well, one of those variables in there contains something like Bob's website and the fact that you’re blindly injecting that into your query will give you something like:

UPDATE Scholarships2 SET Requirements2 = 'Bob's website' ...

This particular query will not go down well with the SQL parser 🙂

Other possibilities that don’t immediately choke the parser will also not go down well with your customer base when little Bobby Tables steals or deletes your credit card database.

See this link for a fuller explanation and strategies for avoidance. In your case, that’s probably going to involve mysql-real-escape-string.

In other words, you’ll need something like:

mysql_query(
    "UPDATE Scholarships2 SET Requirements2 = '" .
    mysql_real_escape_string($requirements2) .
    "' WHERE scholarshipID = '" .
    mysql_real_escape_string($sID) .
    "'"
) or die("Insert Error1: ".mysql_error());

---

As an aside, if $sID is just an integer (and not subject to injection attacks), you could probably remove the quotes from around it. I don’t think it matters with MySQL (due to its “everything is a string” nature) but your query won’t be portable to other DBMS’.