[SOLVED] Updating values in mySQL db (wrong syntax?)

[dmccabe]

I am doing something wrong with my syntax, but I cant work out what:

 

		$aid = $_POST['AID'];
	$update = "UPDATE `tbl_corpaccount` SET `accname` = '". htmlspecialchars($_POST['accname']) ."', 
		`accmgr` = '". htmlspecialchars($_POST['accmgr']) ."',
		`acctel` = '". htmlspecialchars($_POST['acctel']) ."',
		`accno` = '". htmlspecialchars($_POST['accno']) ."',
		`accorderno` = '". htmlspecialchars($_POST['accorderno']) ."',
		`accemail` = '". htmlspecialchars($_POST['accrmail']) ."',
		`contname` = '". htmlspecialchars($_POST['contname']) ."',
		`conttel` = '". htmlspecialchars($_POST['conttel']) ."',
		`email_cofirm` = '". htmlspecialchars($_POST['email_confirm']) ."',
		`cdw` = '". htmlspecialchars($_POST['cdw']) ."',
		`hoi` = '". htmlspecialchars($_POST['hoi']) ."',
		`delhours` = '". htmlspecialchars($_POST['dellhours']) ."',
		`delradius` = '". htmlspecialchars($_POST['delradius']) ."',
		`delcharge` = '". htmlspecialchars($_POST['delcharge']) ."',
		`delfreemiles` = '". htmlspecialchars($_POST['delfreemiles']) ."',
		`delexcess` = '". htmlspecialchars($_POST['delexcess']) ."',
		`add_driver_fee` = '". htmlspecialchars($_POST['add_driver_fee']) ."',
		`colinstructions` = '". htmlspecialchars($_POST['colinstructions']) ."',
		`pnr` = '". htmlspecialchars($_POST['pnr']) ."',
		`dorr` = '". htmlspecialchars($_POST['dorr']) ."',
		`ffr` = '". htmlspecialchars($_POST['ffr']) ."',
		`fbt` = '". htmlspecialchars($_POST['fbt']) ."',
		`dl` = '". htmlspecialchars($_POST['dl']) ."',
		`cc` = '". htmlspecialchars($_POST['cc']) ."',
		`mrt` = '". htmlspecialchars($_POST['mrt']) ."',
		`il` = '". htmlspecialchars($_POST['il']) ."',
		WHERE aid = '$aid' ";

 

Gives me:

 

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE aid = '10'' at line 1

[.josh]

think you need to take out that last comma before WHERE

 

edit: I also suggest you clean your variables before sending them to your database. That script is begging for sql injection.

[dmccabe]

tis quite ok with the SQL injection as this is for an internal web page that has no need of being secure as it is only accessible by the 1 person who is allowed to use it.

 

also you were correct with the comma, thank you very much