MySQL UPDATE problem

[Paldo]

Hi guys!

I trying to get captcha working, I wanted to store the randomly generated string into database, but I crashed on an error I don't understeand.

When I want to load this image.php it say that Unknown column 'qq2svf' in 'field list' and this  'qq2svf' changes every time seems to me like it's the random string I use in my captch, but as you can see I'm not using it in way that it could couse this error.

I don't know.

Thanks for your help. 

<?php
$img = imagecreatetruecolor(80,30);

$white = imagecolorallocate($img, 255, 255, 255);
$black = imagecolorallocate($img, 0, 0, 0);
$grey = imagecolorallocate($img,150,150,150);
$red = imagecolorallocate($img, 255, 0, 0);
$pink = imagecolorallocate($img, 200, 0, 150);

function randomString($length){
    $chars = "abcdefghijkmnopqrstuvwxyz023456789";
    srand((double)microtime()*1000000);
    $str = "";
    $i = 0;
    
        while($i <= $length){
            $num = rand() % 33;
            $tmp = substr($chars, $num, 1);
            $str = $str . $tmp;
            $i++;
        }
    return $str;
}

for($i=1;$i<=rand(1,5);$i++){
    $color = (rand(1,2) == 1) ? $pink : $red;
    imageline($img,rand(5,70),rand(5,20), rand(5,70)+5,rand(5,20)+5, $color);
}

imagefill($img, 0, 0, $red);

$string = randomString(5);
$con = mysql_connect("mysql.webzdarma.cz","parobek","adnddnd");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("parobek", $con);

mysql_query("UPDATE Hlasovanie SET meno = $string
WHERE pocet= 99 ") or die(mysql_error()) ;

mysql_close($con);

imagettftext($img, 13, 0, 10, 20, $black, "CALIBRI.TTF", $string);

header("Content-type: image/png");
imagepng($img);
imagedestroy($img);

?> 

 

[scvinodkumar]

mysql_query("UPDATE Hlasovanie SET meno ='".$string."' WHERE pocet= 99 ") or die(mysql_error()) ;

[PFMaBiSmAd]

And the explanation why (so you will know why the error is occurring and won't repeat this problem in the future) is that string data must be enclosed in single-quotes in the query so that it is treated as a string instead of as a column identifier or an sql keyword.

[scvinodkumar]

hi PFMaBiSmAd, really you have done very good job, thanks for your explanation.

[PFMaBiSmAd]

When you just post "fixed" code without an explanation of what was changed in it or why, it does not really help the OP learn anything because the person needing help does not understand what he was doing wrong in the first place and does not automatically get the reason for the change in the "fixed" code either.