-2

I am currently attempting to create a dashboard for a personal trainer where they can update client records. I have a mySQL database and I am using PHP as the scripting language.

What I want to do: Be able to update client information via HTML input boxes. (Which I have already created). The first being username - which should correspond to a username in the mySQL database. Then the information in the next three input boxes should be inserted into the correct fields in the database.

The Problem: I currently cannot get the SQL statement to work correctly as the Client username is not recognized. This is the error message I am currently receiving :

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ') WHERE Client_username = JSmith' at line 1

JSMith is a valid username in the database.

Below is the PHP I am attempting to use:

//insert

$value1 = $_POST['height1'];
$value2 = $_POST['weight1'];
$value3 = $_POST['bodyfat1'];
$value4 = $_POST['username'];

        $sql = "UPDATE client SET Height='$value1', Weight='$value2', Body_fat='$value3') WHERE Client_username = $value4";

if (!mysqli_query($con,$sql))
  {
    die('Error: ' . mysqli_error($con));
  }

mysqli_close($con);

 ?>

My connection etc is working just fine.

If ayone could help me out that would be great!

16
  • 2
    SQL told you what's wrong. Remove the bracket '$value3') <= right there. Then possibly quote $value4 if it's a string which seems most likely. $_POST['username'] <= Feb 11, 2015 at 19:28
  • 3
    remove both bracket in Body_fat='$value3') and your question too
    – u_mulder
    Feb 11, 2015 at 19:28
  • 1
    ^ I agree with that ^ (u_mulder's) just delete this. Answered in comments. Feb 11, 2015 at 19:29
  • 3
    Error messages , pffffft. Feb 11, 2015 at 19:30
  • 2
    We've quit warning people @EdGibbs, seems they don't listen (or read) anyhow. Feb 11, 2015 at 19:37

1 Answer 1

2

Here's the deal.

The first error is coming from the bracket just before your where clause:

$sql = "UPDATE client SET Height='$value1', Weight='$value2', Body_fat='$value3') WHERE...
                                                                                ^ there

Remove it.

MySQL was telling you:

...right syntax to use near ') WHERE
                             ^

Then, the "username" which is a string, needs to be treated as such, therefore wrapping the $value4 variable in your where clause with quotes.

WHERE Client_username = '$value4'

However, I need to point out that your present code is open to SQL injection. Use mysqli with prepared statements, or PDO with prepared statements, they're much safer.


An insight:

Make sure that your form contains name attributes to go with your POSTs, and contain no typos, and that letter-case matches.

Add error reporting to the top of your file(s) which will help find errors.

<?php 
error_reporting(E_ALL);
ini_set('display_errors', 1);

// rest of your code

Sidenote: Error reporting should only be done in staging, and never production.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.