Cutting a piece of text in MySQL - php

Question

I need cut a piece of text fragment starting with "<div".
I have some like this:
$query = mysql_query("Select * from products_description");
while($row = mysql_fetch_array($query))
{
$usun = substr($row['products_description'], 0, strpos($row['products_description'], "<div"));
mysql_query('UPDATE products_description SET products_description = '.$usun.' WHERE products_id = '.$row['products_id'].'');
}
Unfortunately it does not work

Answer 1

If we echo out the SQL text (the UPDATE statement the code is attempting to execute), we'd see part of the problem.
String literals need to be enclosed in single quotes.
... SET products_description = 'string literal' WHERE ...
^ ^
Another issue is that we don't see any guarantee that the string literal value isn't going to include potentially unsafe values, such as a single quote. Potentially unsafe values should be properly escaped before they are included in SQL text.
Of course, if we used a prepared statement with bind placeholders, we would entirely avoid both of those problems.
Assuming that the PHP substr function is returning the value you want assigned to the column... there's really no need to process RBAR (row by agonizing row), when we could accomplish the same thing in one swoop.
UPDATE mytable SET mycol = SUBSTRING_INDEX(mycol,'<div',1) ;
We can test our expressions in a SELECT statement, before we commit to running an UPDATE statement. For example:
SELECT t.mycol
, SUBSTRING_INDEX(t.mycol,'<div',1) AS newval
FROM mytable t

Answer 2

Firstly, use PDO rather than mysqli_ or mysql_ functions. Then you can use parameter binding. It helps to prevent SQL injection.
You should quote your $usun before concatenating it into the SQL request:
$usun=mysql_real_escape_string($usun);

Answer 3

It's unclear why the exact code in your question isn't working, (although the quoting issue others have pointed out is definitely part of the problem) but this may answer the question anyway since I'm proposing something completely different.
Try just doing one update query to remove the <div at the beginning of the string instead of the select/loop/update approach.
UPDATE products_description
SET products_description = SUBSTRING(products_description FROM 5)
WHERE products_description LIKE '<div%'
Or if you want to remove everything after the <div:
UPDATE products_description
SET products_description = '<div'
WHERE products_description LIKE '<div%'