| Re: Help required with UPDATE columns [message #179542 is a reply to message #179540] |
Tue, 06 November 2012 17:59   |
Thomas 'PointedEars'
Messages: 701
Registered: October 2010
Karma:
|
Senior Member |
|
|
Shake wrote:
> El 06/11/2012 13:40, Dynamo escribió:
>> $query1 = ("UPDATE mytable SET drawing = 'mydrawing.pdf' WHERE id=2");
> [...]
>> $query1 = ("UPDATE mytable SET drawing = $drawing WHERE id=2");
>
> -------------------------------------------^
>
> There are no quotes.
Either one allows for SQL injection. The OP should read on Prepared
Statements (but at least mysql_real_escape_string()) instead.
> Incorrect:
> - $query1 = ("UPDATE mytable SET drawing = $drawing WHERE id=2");
> correct:
> - $query1 = ("UPDATE mytable SET drawing = '$drawing' WHERE id=2");
The parentheses are unnecessary and misleading. The names should be
backtick-quoted.
> That's not a PHP problem. Is a SQL one.
_MySQL_, and you do not appear to know either very well.
PointedEars
--
Danny Goodman's books are out of date and teach practices that are
positively harmful for cross-browser scripting.
-- Richard Cornford, cljs, <cife6q$253$1$8300dec7(at)news(dot)demon(dot)co(dot)uk> (2004)
|
|
|
|
Calendar
Search
Help
Members
Register
Login
Home
]