What is wrong with this update statement?

Posted on 2016-07-26
Last Modified: 2016-07-28
Here's my code:

$jorja="update features set featurename='$_POST[feature_name_'.$vivian_row[id]]' where id=$vivian_row['id']";

The error I get is "Parse error: syntax error, unexpected '' (T_ENCAPSED_AND_WHITESPACE), expecting ']' in C:\wamp\www\kitchen\adm\features_edit.php on line 20"

I don't see what the problem is...
Question by:brucegust
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions

Author Comment

ID: 41730218
I made this change:

$jorja="update features set featurename='$_POST[feature_name_'.$vivian_row['id'].']' where id='$vivian_row[id]'";

Same error.

LVL 143

Assisted Solution

by:Guy Hengel [angelIII / a3]
Guy Hengel [angelIII / a3] earned 83 total points
ID: 41730219
$jorja="update features set featurename='" . $_POST['feature_name_'.$vivian_row[id]] ."' where id=$vivian_row['id']";
LVL 53

Assisted Solution

by:Scott Fell, EE MVE
Scott Fell,  EE MVE earned 83 total points
ID: 41730252

While I am sure Guy's code is good and meets your needs for the purpose of this question, you should really sanitize your data before updating.    Updating or adding raw posted and concatenated data to your database is not very safe.

At the very least, sanitize and use an abstraction if you are not already

$feature_name = $_POST[feature_name];
$new_feature_name = filter_var($feature_name , FILTER_SANITIZE_STRING).$vivian_row[id];
$jorja="update features set featurename='" . $new_feature_name  ."' where id=$vivian_row['id']";
Salesforce Made Easy to Use

On-screen guidance at the moment of need enables you & your employees to focus on the core, you can now boost your adoption rates swiftly and simply with one easy tool.

LVL 110

Accepted Solution

Ray Paseur earned 251 total points
ID: 41730259
There are several problems here, but nothing that can't be simplified and corrected easily.

If you're making reference to $_POST in a query string it almost certainly means your script is vulnerable to external attacks.  You probably want to use MySQLI::real_escape_string() or a similar "minimum-level" method to sanitize the external data.

If you're using an associative array index without quotation marks, you're at risk that a defined constant could cause a name collision, and in any case, your code will raise an unwanted Notice message.  Learn more about how PHP quotes and apostrophes work here.

If you're using compound statements, you're writing code that is brittle and hard to debug.  This is probably the source of the parse error -- it's difficult to see where the quote marks are supposed to go in compound statements and arguments.  So just don't do that!  You can make this easier on yourself by writing simple, unit-level statements.  Please see AntiPractices 9 and 9a.

Here is how I might do it.  You can create different variables, and each of these variables can be fed to var_dump() so you can see what the variable(s) contain.  Much easier than guessing whether your syntax is correct!  For links to the PHP var_dump() man page, please refer back to your recent questions.
// ISOLATE vivian_row id 
$vrid    = $vivian_row['id'];
$ok_vrid = $mysqli->real_escape_String($vrid);

// ISOLATE POST-REQUEST feature_name_
$pfid    = 'feature_name_' . $vrid;
$ok_pfid = $mysqli->real_escape_String($pfid);

$jorja   = "UPDATE features SET featurename='$ok_pfid' WHERE id='$ok_vrid'";

Open in new window


Assisted Solution

by:Vatsal Shah
Vatsal Shah earned 83 total points
ID: 41731197
Please Try Below Code.
$jorja="update features set featurename={$_POST['feature_name_'.$vivian_row['id']]} where id=".$vivian_row['id'];

Open in new window

LVL 110

Expert Comment

by:Ray Paseur
ID: 41733069
To anyone coming across this in the future, the "assisted solution" from Vatsal Shah perpetuates one of the many dangerous practices that novice PHP programmers often follow without understanding the risks.  

Do not use unfiltered values from any external variable (in this case $_POST) in a query string.

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I imagine that there are some, like me, who require a way of getting currency exchange rates for implementation in web project from time to time, so I thought I would share a solution that I have developed for this purpose. It turns out that Yaho…
Since pre-biblical times, humans have sought ways to keep secrets, and share the secrets selectively.  This article explores the ways PHP can be used to hide and encrypt information.
Explain concepts important to validation of email addresses with regular expressions. Applies to most languages/tools that uses regular expressions. Consider email address RFCs: Look at HTML5 form input element (with type=email) regex pattern: T…
The viewer will learn how to create a basic form using some HTML5 and PHP for later processing. Set up your basic HTML file. Open your form tag and set the method and action attributes.: (CODE) Set up your first few inputs one for the name and …

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question