I have been trying to get past this error all day. I am unable to
determine why I get syntax error from the following code:

//modify a record
$myDataID = mysql_query("UPDATE members SET first_name = $name_update
WHERE email = $targetEmail", $connectID);

Can someone tell me what is wrong with this.
Thank You
Gerald Stanley

On Sep 5, 10:02*pm, stanman <GStanle...@gmail.comwrote:

I have been trying to get past this error all day. I am unable to
determine why I get syntax error from the following code:
>
//modify a record
$myDataID = mysql_query("UPDATE members SET first_name = $name_update
WHERE email = $targetEmail", $connectID);
>
Can someone tell me what is wrong with this.
Thank You
Gerald Stanley

Please post a few lines before this and also the full error message.

stanman wrote:

I have been trying to get past this error all day. I am unable to
determine why I get syntax error from the following code:
>
//modify a record
$myDataID = mysql_query("UPDATE members SET first_name = $name_update
WHERE email = $targetEmail", $connectID);
>
Can someone tell me what is wrong with this.
Thank You
Gerald Stanley

You may try:

$myDataID = mysql_query("UPDATE members SET first_name = '$name_update'
WHERE email = '$targetEmail'", $connectID);

scotty

stanman wrote:

I have been trying to get past this error all day. I am unable to
determine why I get syntax error from the following code:
>
//modify a record
$myDataID = mysql_query("UPDATE members SET first_name = $name_update
WHERE email = $targetEmail", $connectID);
>
Can someone tell me what is wrong with this.

It's off-topic, but you should try to escape the string inputs, or
avoid combining inputs to query completely by using parameterized
queries.

A simple version is "UPDATE members SET first_name = '" .
mysql_escape_string($name_update) . "' WHERE email = '" .
mysql_escape_string($targetEmail) . "'"

You would also need to make sure the client encoding is correct.

If you're using PHP5, you can use parameterized queries in mysqli or
PDO

AqD wrote:

stanman wrote:

>
It's off-topic, but you should try to escape the string inputs, or
avoid combining inputs to query completely by using parameterized
queries.
>
A simple version is "UPDATE members SET first_name = '" .
mysql_escape_string($name_update) . "' WHERE email = '" .
mysql_escape_string($targetEmail) . "'"
>
You would also need to make sure the client encoding is correct.
>
If you're using PHP5, you can use parameterized queries in mysqli or
PDO
>

Properly constructed statements work quite well without parameterized
queries.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

AqD wrote:

stanman wrote:

>
It's off-topic, but you should try to escape the string inputs, or
avoid combining inputs to query completely by using parameterized
queries.
>
A simple version is "UPDATE members SET first_name = '" .
mysql_escape_string($name_update) . "' WHERE email = '" .
mysql_escape_string($targetEmail) . "'"
>
You would also need to make sure the client encoding is correct.

Use mysql_real_escape_string for this.

If you're using PHP5, you can use parameterized queries in mysqli or
PDO

--
Curtis