SQL语法错误[关闭]

I have the following code.

<?php
include ('include/DB_Functions.php');

if(isset($_POST['submit']))
{   $id =$_REQUEST['roomid'];
    $title = $_POST['title'];
    $uid = $_POST['clientId'];
    $location = $_POST['location'];
    $quantity = $_POST['number'];
    $price = $_POST['price'];
    $size = $_POST['size'];
    $description = $_POST['description'];
    $categoryID = 1;
    $sellerAddress = $_POST['selleradd'];
    $sellerPhone = $_POST['sellerphn'];

    mysql_query("UPDATE room_tb SET location ='$location', quantity ='$quantity',price ='$price',area ='$size' description = '$description' postTitle = '$title' WHERE roomID = '$id'")
                or die(mysql_error()); 

    echo "Saved!";  

header('Location:table.php'); 
}

I get an error.. You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'description = '' postTitle = '' WHERE roomID = '983'' at line 1 What have i done wrong. The DB_Functions.php contains all database connectivity.

Well of course, look at your sql query... it's missing commas.

UPDATE room_tb SET location ='$location', quantity ='$quantity',price ='$price',area ='$size' description = '$description' postTitle = '$title' WHERE roomID = '$id'"

Should be:

UPDATE room_tb SET location ='$location', quantity ='$quantity', price ='$price', 
area ='$size', description = '$description', postTitle = '$title' WHERE roomID = '$id'"

You have missing comma between these area ='$size' description = '$description' postTitle = '$title'

I wanted to leave it off at just comment but wanted to recommend a few other suggestions:

  1. You are still using deprecated mysql_ functions, you should take care of that using either mysqli or pdo.
  2. You want to fix your code so that its not open to SQL injection attack. Have a look at adding mysql_real_escape_string() function on those request and post variables. Please read this page on SQL Injection.

The applied fix to your query which was causing this error is here:

mysql_query("UPDATE room_tb SET location ='$location', quantity ='$quantity',price ='$price',area ='$size', description = '$description', postTitle = '$title' WHERE roomID = '$id'") or die(mysql_error());

✓ Two missing commas in the following:


area ='$size' description = '$description' postTitle = '$title'
             ^                            ^

should read as:

area ='$size', description = '$description', postTitle = '$title'

You are missing comma in your code.

mysql_query("UPDATE room_tb SET location ='$location', quantity ='$quantity',price ='$price',area ='$size' ,description = '$description' ,postTitle = '$title' WHERE roomID = $id")
            or die(mysql_error()); 

and dont use '$id' since it is an integer. no need for quotes.

Your query most likely seems to be missing two commas:

UPDATE room_tb 
SET location ='$location', 
    quantity ='$quantity',
    price ='$price',
    area ='$size',   <= missing
    description = '$description',  <= missing
    postTitle = '$title' 
WHERE roomID = '$id'

Two additional advices:

  1. The MySQL extension is deprecated as of PHP 5.5.0, and will be removed in the future. Instead, the MySQLi or PDO_MySQL extension should be used.
  2. Your code leaves the doors for SQL injection wide open. At least put a mysql_real_escape_string() somewhere before using the $_POST-variables in your statement and filter the $_POST-variables .
<?php
include ('include/DB_Functions.php');
extract($_POST);

if (isset($submit)){
    $sql="UPDATE room_tb SET location ='$location', quantity ='$number',price ='$price',area ='$size', description = '$description', postTitle = '$title' WHERE roomID = '$roomid'";
    mysql_query($sql) or die(mysql_error());
    header('Location:table.php'); 
}