Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #7473

Re: Help required with UPDATE columns

Message-ID <2525795.FS5DWkFXQh@PointedEars.de> (permalink)
From Thomas 'PointedEars' Lahn <PointedEars@web.de>
Organization PointedEars Software (PES)
Date 2012-11-06 18:59 +0100
Subject Re: Help required with UPDATE columns
Newsgroups comp.lang.php
References <ff0i989e35u20dfsfalfah7e77o4lbit41@4ax.com> <k7b0nc$vvr$1@dont-email.me>
Followup-To comp.lang.php

Followups directed to: comp.lang.php

Show all headers | View raw

Shake wrote:

> El 06/11/2012 13:40, Dynamo escribió:
>> $query1 = ("UPDATE mytable SET drawing = 'mydrawing.pdf' WHERE id=2");
> [...]
>> $query1 = ("UPDATE mytable SET drawing = $drawing WHERE id=2");
> 
> -------------------------------------------^
> 
> There are no quotes.

Either one allows for SQL injection.  The OP should read on Prepared 
Statements (but at least mysql_real_escape_string()) instead.

> Incorrect:
> - $query1 = ("UPDATE mytable SET drawing = $drawing WHERE id=2");
> correct:
> - $query1 = ("UPDATE mytable SET drawing = '$drawing' WHERE id=2");

The parentheses are unnecessary and misleading.  The names should be 
backtick-quoted.
  
> That's not a PHP problem. Is a SQL one.

_MySQL_, and you do not appear to know either very well.


PointedEars
-- 
Danny Goodman's books are out of date and teach practices that are
positively harmful for cross-browser scripting.
  -- Richard Cornford, cljs, <cife6q$253$1$8300dec7@news.demon.co.uk> (2004)

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Help required with UPDATE columns Dynamo - 2012-11-06 12:40 +0000
  Re: Help required with UPDATE columns Shake <QUITAESTO@QUITAESTO.NOES> - 2012-11-06 13:44 +0100
    Re: Help required with UPDATE columns Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-11-06 18:59 +0100
      Re: Help required with UPDATE columns Shake <QUITAESTO@QUITAESTO.NOES> - 2012-11-06 19:06 +0100
        Re: Help required with UPDATE columns Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-11-06 19:13 +0100
          Re: Help required with UPDATE columns Shake <QUITAESTO@QUITAESTO.NOES> - 2012-11-06 19:20 +0100
            Re: Help required with UPDATE columns "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-11-06 19:30 +0100
              Re: Help required with UPDATE columns Shake <QUITAESTO@QUITAESTO.NOES> - 2012-11-06 19:45 +0100
                Re: Help required with UPDATE columns Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-11-06 19:57 +0100
                Re: Help required with UPDATE columns "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-11-06 20:36 +0100
            Re: Help required with UPDATE columns Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-11-06 19:53 +0100
              Re: Help required with UPDATE columns Shake <alex.estevezQUENO@QUENOfilnet.es> - 2012-11-06 20:36 +0100
            Re: Help required with UPDATE columns Jerry Stuckle <jstucklex@attglobal.net> - 2012-11-06 15:02 -0500
    Re: Help required with UPDATE columns Dynamo - 2012-11-07 11:07 +0000
  Re: Help required with UPDATE columns Jerry Stuckle <jstucklex@attglobal.net> - 2012-11-06 08:15 -0500
    Re: Help required with UPDATE columns Dynamo - 2012-11-07 11:05 +0000
      Re: Help required with UPDATE columns Jerry Stuckle <jstucklex@attglobal.net> - 2012-11-07 07:07 -0500

csiph-web