PHP/MYSQL Update query not working

Question

Can anyone tell my why this update query is not working?

if ($_GET['update']) {
include 'config.php';
//Connect to MYSQL Database server
$connect = mysql_connect(DB_HOST, DB_USER, DB_PASS) or die("Could not connect to MYSQL Database.");
$result = mysql_select_db(DB_NAME, $connect) or die("Could not connect to MYSQL table.");

mysql_query("UPDATE contact SET read = 1 WHERE id = '$_GET[update]'")or die("Query failed.");
echo "Update works!";
} else {
echo "Update does not work...ughh.";
}

Thank you in advance.

Edit: I got the query to work. For anyone who was worrying about the security, I was using this script as a test to see if I wanted to use it. I just added the security now that the script works. Thank you all for the help and tips.

Solution 1

What is column read?

mysql_query("UPDATE contact SET read = 1 WHERE id = '$_GET[update]'")

Judging by the non-capitalization of read, I suspect you are using a reserved word in MySQL for that column.

See:

Reserved Words in MySQL

To Get around this, just put a single quote around read. I.E.

mysql_query("UPDATE contact SET 'read' = 1 WHERE id = '$_GET[update]'")

Or better per j.bruni:

mysql_query("UPDATE contact SET `read` = 1 WHERE id = '$_GET[update]'")

Solution 2

Try this for your query line:

mysql_query("UPDATE contact SET read = 1 WHERE id = '".$_GET[update]."'")or die("Query failed: " . mysql_error());

Notice the change of the die() statement for better error handling:

die("Query failed: " . mysql_error());

*Also, just an FYI, you should really escape user variables (e.g. GET variables) like so to prevent SQL injections:

mysql_query("UPDATE contact SET read = 1 WHERE id = '".mysql_real_escape_string($_GET[update])."'")or die("Query failed: " . mysql_error());

Please report back the result.

Solution 3

I believe you need to escape the string to have $_GET['update'] to add it's value to the string. But you really should be using prepared statements least you be attacked by malicious users.

Prepared Statements: http://php.net/manual/en/pdo.prepared-statements.php

Solution 4

READ is a reserved word. You need to put it within backticks or rename your field.

Take a look at this link:

http://dev.mysql.com/doc/refman/5.5/en/reserved-words.html

View more solutions