Get content from Database and Updating the content generates Error - php

Question

I am retrieving data from the joomla Database.
I am searching for the tag <img alt=''"> in the content and I want the alt tag value as the articles title.
But when I Update the content in database I get the following error.
"Error updating record: You have an error in your SQL syntax; check
the manual that corresponds to your MySQL server version for the right
syntax to use near 's, each catering to different testing needs of an
organization. It has f' at line 1"
Please Check the Code given below.
$link= "SELECT * FROM as23dc_content LIMIT 1";
$link_result = mysqli_query($conn, $link);
while($row_link= mysqli_fetch_assoc($link_result)) {
$content = $row_link["introtext"];
$add_alt_title = 'alt="'.$row_link["title"].'"';
$content1 = preg_replace('/(alt)=("[^"]*")/i', "$add_alt_title", $content);
//echo $content1;
$sql = "UPDATE as23dc_content SET introtext='".$content1."' WHERE id='".$row_link["id"]."'";
//print_r($sql);
if(mysqli_query($conn, $sql)) {
echo "Record updated successfully";
} else {
echo "Error updating record: " . mysqli_error($conn);
}
}

Answer 1

The problem is that your $content1 string has quotes that confuse the SQL parser because it has a hard time knowing where that value ends.
Use prepared statements instead because they make it impossible for the parser to become confused
//Put '?' where the values would be
$sql = "UPDATE as23dc_content SET introtext = ? WHERE id = ?"
$stmt = mysqli_prepare($conn, $sql) or die (mysqli_error($conn));
//bind the values to the '?' parameters (replace 's' with 'i' for integer values)
$stmt->bind_param('ss', $content1, $row_link['id']);
//execute the query and abort on error
$stmt->execute() or die ($stmt->error);
if($stmt->affected_rows) echo "Record updated successfully."
else echo "Record could not be found. No change was made."

Answer 2

I'm almost sure that you are generating invalid sql.
introtext='".$content1."'
witch generate something like
introtext='sometest'
Pay attention to the quotes!
Same goes for
id='".$row_link["id"]."'"
is the problem (unsafe too)
Please read
How to use mysqli prepared statements in PHP?
and official php docs http://php.net/manual/en/mysqli.prepare.php

Answer 3

You can escape single quotes using this
$content1 = preg_replace('/(alt)=("[^"]*")/i', "$add_alt_title", $content);
$content1 = mysqli_real_escape_string($conn, $content1);//Procedural
OR
$content1 = preg_replace('/(alt)=("[^"]*")/i', "$add_alt_title", $content);
$content1 = $conn->real_escape_string($content1);//OOPS
After this you can insert into database.