PHP CSV import script error

[phpnewbie88]

include "connect.php";

if(isset($_POST['submit']))

   {

     $filename=$_POST['filename'];

     $handle = fopen("$filename", "r");

     while (($data = fgetcsv($handle, 1000, ",")) !== FALSE)

     {

    

       $import="UPDATE isc_products(prodavailability,prodinvtrack,prodcurrentinv) values('$data[1]','$data[2]','$data[3]') where vendor_id = '($data[0])' ";

       mysql_query($import) or die(mysql_error());

     }

     fclose($handle);

     print "Import done";



   }

   else

   {



      print "<form action='inv_update.php' method='post'>";

      print "Type file name to import:<br>";

      print "<input type='text' name='filename' size='20'><br>";

      print "<input type='submit' name='submit' value='submit'></form>";

   }




?>

 

 

I am building this script to import some data via a csv that has three fields. The where statement gives me this error - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '(prodavailability,prodinvtrack,prodcurrentinv) values('35','1','35') where vendo' at line 1.

 

I'm know my syntax is flawed but can't find a solution to this.... any one point me in the right direction? I know just enough php to get myself in trouble!! lol

[taquitosensei]

you're doing an update with the syntax for insert, and you'll want to escape the data

loop
{
foreach($data as $k=>$v) { $data[$k]=mysql_real_escape_string($v); }
$import="UPDATE isc_products set prodavailability='".$data[1]."',prodinvtrack='".$data[2]."', prodcurrentinv='".$data[3]."' where vendor_id='".$data[0]."'"; 
mysql_query($import) or die(mysql_error());
}

[The Letter E]

include "connect.php";

if(isset($_POST['submit']))

   {

     $filename=$_POST['filename'];

     $handle = fopen("$filename", "r");

     while (($data = fgetcsv($handle, 1000, ",")) !== FALSE)

     {

    

       $import="UPDATE isc_products(prodavailability,prodinvtrack,prodcurrentinv) values('$data[1]','$data[2]','$data[3]') where vendor_id = '($data[0])' ";

       mysql_query($import) or die(mysql_error());

     }

     fclose($handle);

     print "Import done";



   }

   else

   {



      print "<form action='inv_update.php' method='post'>";

      print "Type file name to import:<br>";

      print "<input type='text' name='filename' size='20'><br>";

      print "<input type='submit' name='submit' value='submit'></form>";

   }




?>

 

 

I am building this script to import some data via a csv that has three fields. The where statement gives me this error - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '(prodavailability,prodinvtrack,prodcurrentinv) values('35','1','35') where vendo' at line 1.

 

I'm know my syntax is flawed but can't find a solution to this.... any one point me in the right direction? I know just enough php to get myself in trouble!! lol

 

Try this:

$import="UPDATE isc_products(prodavailability,prodinvtrack,prodcurrentinv) values('".$data[1]."','".$data[2]."','".$data[3]."') where vendor_id = '".$data[0]."' ";