Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

What is wrong with this update statement?

Posted on 2016-07-26
7
Medium Priority
?
81 Views
Last Modified: 2017-07-21
Here's my code:

$jorja="update features set featurename='$_POST[feature_name_'.$vivian_row[id]]' where id=$vivian_row['id']";

The error I get is "Parse error: syntax error, unexpected '' (T_ENCAPSED_AND_WHITESPACE), expecting ']' in C:\wamp\www\kitchen\adm\features_edit.php on line 20"

I don't see what the problem is...
0
Comment
Question by:brucegust
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
7 Comments
 

Author Comment

by:brucegust
ID: 41730218
I made this change:

$jorja="update features set featurename='$_POST[feature_name_'.$vivian_row['id'].']' where id='$vivian_row[id]'";

Same error.

What?
0
 
LVL 143

Assisted Solution

by:Guy Hengel [angelIII / a3]
Guy Hengel [angelIII / a3] earned 332 total points
ID: 41730219
$jorja="update features set featurename='" . $_POST['feature_name_'.$vivian_row[id]] ."' where id=$vivian_row['id']";
0
 
LVL 54

Assisted Solution

by:Scott Fell, EE MVE
Scott Fell,  EE MVE earned 332 total points
ID: 41730252
NO POINTS

While I am sure Guy's code is good and meets your needs for the purpose of this question, you should really sanitize your data before updating.    Updating or adding raw posted and concatenated data to your database is not very safe.

At the very least, sanitize http://php.net/manual/en/filter.filters.sanitize.php and use an abstraction if you are not already http://php.net/manual/en/intro.pdo.php


$feature_name = $_POST[feature_name];
$new_feature_name = filter_var($feature_name , FILTER_SANITIZE_STRING).$vivian_row[id];
$jorja="update features set featurename='" . $new_feature_name  ."' where id=$vivian_row['id']";
1
VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

 
LVL 111

Accepted Solution

by:
Ray Paseur earned 1004 total points
ID: 41730259
There are several problems here, but nothing that can't be simplified and corrected easily.

If you're making reference to $_POST in a query string it almost certainly means your script is vulnerable to external attacks.  You probably want to use MySQLI::real_escape_string() or a similar "minimum-level" method to sanitize the external data.

If you're using an associative array index without quotation marks, you're at risk that a defined constant could cause a name collision, and in any case, your code will raise an unwanted Notice message.  Learn more about how PHP quotes and apostrophes work here.
https://www.experts-exchange.com/articles/12241/Quotation-Marks-in-PHP.html

If you're using compound statements, you're writing code that is brittle and hard to debug.  This is probably the source of the parse error -- it's difficult to see where the quote marks are supposed to go in compound statements and arguments.  So just don't do that!  You can make this easier on yourself by writing simple, unit-level statements.  Please see AntiPractices 9 and 9a.

Here is how I might do it.  You can create different variables, and each of these variables can be fed to var_dump() so you can see what the variable(s) contain.  Much easier than guessing whether your syntax is correct!  For links to the PHP var_dump() man page, please refer back to your recent questions.
// ISOLATE vivian_row id 
$vrid    = $vivian_row['id'];
$ok_vrid = $mysqli->real_escape_String($vrid);

// ISOLATE POST-REQUEST feature_name_
$pfid    = 'feature_name_' . $vrid;
$ok_pfid = $mysqli->real_escape_String($pfid);

// CONSTRUCT THE QUERY -- DO YOU WANT A TABLE SCAN, OR SHOULD YOU CONSIDER USING A "LIMIT 1" CLAUSE??
$jorja   = "UPDATE features SET featurename='$ok_pfid' WHERE id='$ok_vrid'";

Open in new window

0
 

Assisted Solution

by:Vatsal Shah
Vatsal Shah earned 332 total points
ID: 41731197
Please Try Below Code.
$jorja="update features set featurename={$_POST['feature_name_'.$vivian_row['id']]} where id=".$vivian_row['id'];

Open in new window


Regards,
Vatsal
0
 
LVL 111

Expert Comment

by:Ray Paseur
ID: 41733069
To anyone coming across this in the future, the "assisted solution" from Vatsal Shah perpetuates one of the many dangerous practices that novice PHP programmers often follow without understanding the risks.  

Do not use unfiltered values from any external variable (in this case $_POST) in a query string.
1
 

Expert Comment

by:Vatsal Shah
ID: 42224615
Hey Ray Paseur,

Yes, You are Right to not to send anything directly from user.
But here the issue was with update query, so just gave him solution.
Otherwise it is common practice to validate, sanitize, etc.

Thanks.
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Developers of all skill levels should learn to use current best practices when developing websites. However many developers, new and old, fall into the trap of using deprecated features because this is what so many tutorials and books tell them to u…
Build an array called $myWeek which will hold the array elements Today, Yesterday and then builds up the rest of the week by the name of the day going back 1 week.   (CODE) (CODE) Then you just need to pass your date to the function. If i…
Learn how to match and substitute tagged data using PHP regular expressions. Demonstrated on Windows 7, but also applies to other operating systems. Demonstrated technique applies to PHP (all versions) and Firefox, but very similar techniques will w…
The viewer will learn how to count occurrences of each item in an array.
Suggested Courses

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question