$id = $_REQUEST["Uid"];
$query = "update prd set name='".$_POST['nm']."', char='".$_POST['ch']."', price='".$_POST['pr']."', sp_pri='".$_POST['spr']."', is_eli='".$_POST['enb']."', upd='".$_POST['ud']."', img='".$_FILES['img']['name']."', c_id='".$_POST['cid']."' where id=".$id;
$r = mysql_query($query) or die(mysql_error());
if ($r == 1)
echo "Record Updated";
I'm getting the following error from this query but I'm not sure how to solve it - the SQL looks OK to me! What am I doing wrong?
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'char='b', price='150', sp_pri='100', is_eli='Yes', upd='Mon Jul 23 2012 17:23:24' at line 1
char is a reserved word within SQL. If you use such keywords as column names you must enclose them in backticks (as you should always do with column names)!
$query="update prd set `name`='".$_POST['nm']."', `char`='".$_POST['ch']."', `price`='".$_POST['pr']."', `sp_pri`='".$_POST['spr']."', `is_eli`='".$_POST['enb']."', `upd`='".$_POST['ud']."', `img`='".$_FILES['img']['name']."', `c_id`='".$_POST['cid']."' where `id`=".$id;
Furthermore by adding $_POST variables directly into a query without sanitizing them before, you open your system to any kind of attacks, that compromise your data and web site.
In addition to Sirko's suggestions, in the assignment to field upd which is a date - you should use STR_TO_DATE