MySQLI Update Statement not working - php

Question

<?php
header('Content-Type: application/json');
include '../../connection.php';
$id_e = $_POST['id'];
$location_e = $_POST['location'];
$state_e = $_POST['state'];
$notes_e = $_POST['notes'];
$sql="UPDATE chassis SET location='%$location_e%', state='%$state_e%', notes='%$notes_e%' WHERE id='%$id_e%'";
$query = mysqli_query($db,$sql);
if (!$query) {
echo json_encode(["message"=>mysqli_error($db)]);
}else {
echo json_encode(["message"=>"Success"]);
}
/* I used this code below to check if the data sent by ajax is received
switch($state_e){
case "New":
echo json_encode(["message"=>"hi"]);
break;
default:
echo json_encode(["message"=>"nope"]);
break;
}
}*/
?>
Hi, I'm not sure what the problem with my code is but the UPDATE statement isn't updating my database. I have an ajax jquery posting data which is received by this PHP file. I know that the data is being received by the PHP file because I tried a the piece of code to check it. Also, the query is returning success. I think the problem lies with the UPDATE statement however, I've tried different variations of the UPDATE statement like:
$sql="UPDATE chassis SET location='".$_POST['location']."', state='".$_POST['state']."', notes='".$_POST['notes']."' WHERE id='".$_POST['id']."";
It still doesn't work. I also checked the privileges on the SQL and I have All privileges. Please help, I'm a high school student and this is for my end of year project. Cheers :)

Answer 1

You should be using prepared statements. Also i do not see the reason for adding the % next to the variables as per my comment. Also you should be getting the real error and not just outputting Error
$sql="UPDATE chassis SET location=?, state=?, notes=? WHERE id=?";
$result = $db->prepare($sql);
$result->bind_param('sssi', $location_e, $state_e, $notes_e, $id_e);
echo $result->execute() === true ? 'Success' : 'Failed: '.$result->error;