PHP/MySQL error - cannot update table through form

[Dan06]

I'm trying to update a table based on a session variable. Unfortunately, I keep getting an invalid mysql code error. Below is the code I'm using:

 

if ((isset($_POST["MM_update"])) && ($_POST["MM_update"] == "indProForm")) {
  $updateSQL = sprintf("UPDATE individualprofile SET City=%s, `State`=%s, Zip=%s, WHERE Id=" .$_SESSION['RegId'],
                       GetSQLValueString($_POST['City'], "text"),
                       GetSQLValueString($_POST['State'], "text"),
                       GetSQLValueString($_POST['Zip'], "text"),
                       GetSQLValueString($_POST['Id'], "text"));

  mysql_select_db($database_dbConnection, $dbConnection);
  $Result1 = mysql_query($updateSQL, $dbConnection) or die(mysql_error());
}

Help solving this problem is much appreciated.

[genericnumber1]

what's the error?

[PFMaBiSmAd]

String values must be enclosed in single-quotes so that they are treated as strings instead of identifiers or keywords.

[Dan06]

The error message is:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE Id=' at line 1

 

As for single quotes, I've used this very type of code which uses double quotes, i.e.

"INSERT INTO registration (Id, FirstName, LastName, Email, Password) VALUES (%s, %s, %s, %s, %s)",
                       GetSQLValueString($_POST['Id'],"text"),
                       GetSQLValueString($_POST['FirstName'], "text"),
                       GetSQLValueString($_POST['LastName'], "text"),
                       GetSQLValueString($_POST['Email'], "text"),
                       GetSQLValueString($_POST['Password'], "text"));

for inserting records and there were no problem with that code. Why do you think that is?

[genericnumber1]

try

"INSERT INTO registration (Id, FirstName, LastName, Email, `Password`) VALUES (%s, %s, %s, %s, %s)"

 

password() is a mysql function so you need the ` marks.

 

I think what PFM was talking about is to put ' around %s, but I'm guessing that is one thing that GetSQLValueString() does automatically... if not, you'll want to change all %s to '%s' as well.

[PFMaBiSmAd]

Upon further review (you can tell it is football season in the US), the following part of the query has an extra coma -

 

Zip=%s, WHERE Id="

[genericnumber1]

Upon further review (you can tell it is football season in the US),

 

Yeah, I totally even tried to answer something he didn't have a problem with -- darn television

[Dan06]

The extra comma was the problem! Ah, I completely missed that... Thanks for the help, I appreciate it; you saved me from going insane.