MYSQL PHP - You have an error in your SQL syntax - php

Question

why i always get error in hostgator when try to update this ga field in database, error happen when insert this code in textarea
_gaq.push(['_setCustomVar',1, 'Status', 'Logged In']);
_gaq.push(['_trackEvent', 'Custom', 'PageLoad', 'Setting Logged In State',0,true]);
<textarea name="ga"></textarea>
$name = $_POST['name'];
$ga = trim($_POST['ga']);
$req = "UPDATE `con` SET `name` = '".$name."', `ga` = '".$ga."'");
if (mysqli_query($con, $req)) {
echo "success"
}
You have an error in your SQL syntax; check the manual that
corresponds to your MySQL server version for the right syntax to use
near '_setCustomVar',1, 'Status', 'Logged In']);
_gaq.push(['_trackEvent', 'Custom', ' at line 1
if i remove ga = '".$ga."' my database update but if add this code it give error i have hostgator and it work good in localhost
type of ga in database is text.

Answer 1

Prepared statements are the one stop solution for this. Your code is supposed to be:
$name = trim($_POST['name']);
$ga = trim($_POST['ga']);
$some_value = 'some_value'; //This is just the imaginary value for demonstration
$req = "UPDATE `con` SET `name` = ?, `ga` = ? WHERE column_name = ?";
$stmt = $mysqli->prepare($req);
$stmt->bind_param('sss', $name, $ga, $some_value);
$stmt->execute();
You always want to use WHERE with UPDATE query. If you don't use WHERE clause, the changes will be applied to all records. I suppose you are aware of SQL injection, the notorious attack!
An alternative which can be used to fix the issue with your code is mysqli_real_escape_string().
For example,
$name = mysqli_real_escape_string($con, trim($_POST['name']));
$ga = mysqli_real_escape_string($con, trim($_POST['ga']));
But always use prepared statements as I've shown above.