I need to eliminate the character (") from a column in my database. I can do in mysql command line by the following command:
mysql> UPDATE tName SET colName=REPLACE(colName, '"','');
and it works perfectly. Since i need run in php, i have used the following syntax in php but it dosent work :
$sql0 = "UPDATE tName SET colName=REPLACE(colName,'"','')";
if (mysqli_query($conn, $sql0)) {
$result0 = "Unwanted Character is removed ";
} else {
$result0 = "Error Filtering is Failed: " . $sql . "<br>" . mysqli_error($conn);
}
any Idea??
Try this one instead :
$sql0 = "UPDATE tName SET colName=REPLACE(colName,'\"','')";
notice there is a back slash :)
you have to escape double quotes inside double-quoted strings.
$sql0 = "UPDATE tName SET colName=REPLACE(colName,'\"','')";
if (mysqli_query($conn, $sql0)) {
$result0 = "Unwanted Character is removed ";
} else {
$result0 = "Error Filtering is Failed: " . $sql . "<br>" . mysqli_error($conn);
}
You can use quotes in REPLACE function as:
$one = '"';
$sql0 = "UPDATE tName SET colName = REPLACE(colName,'$one','')";
If you echo $sql0 result is:
UPDATE tName SET colName = REPLACE(colName,'"','')
Related
I am trying to updata a database table using pq_query in PHP. I have the following code:
$q = "UPDATE tableName SET ('data1 = " . $data1 . "', data2='" . $data2 . "') WHERE user=".$user;
$success = pg_query($q);
if (!$success) {
$errormessage = pg_last_error();
echo "Error " . $errormessage;
}
I am getting the following error message:
ERROR: syntax error at or near "'data1 = '"
LINE 1: UPDATE tableName SET ('data1 = 10', data2= 20'') WHERE user=
Replace your query with this query
$q = "UPDATE tableName SET data1 = '$data1', data2='$data2' WHERE user='$user'";
Explaination: You should pass variable in single quotes('') if your query in double quotes.
You are using a lot of quotes which it is not understood by PostgreSQL, try simply this :
$q = "UPDATE tableName SET data1 = " . $data1 . ", data2=" . $data2 . " WHERE user=".$user;
Remove those single quotes !
I am trying to do an Oracle insert statement on a PHP page but I am getting the error below. If I remove the semicolon from the statement, the page never loads (even though the insert on the backend should take a fraction of a second). Any tips would be greatly appreciated!
$sql_update = "
update schema.table set last_check_dt = (select sysdate from dual)
where id = (select id from schema.email where current_email = '" . $email . "');";
$stid = oci_parse($conn, $sql_update);
oci_execute($stid);
oci_commit($conn);
oci_close($conn);
Warning: oci_execute() [function.oci-execute]: ORA-00911: invalid character
$sql_update = "
update schema.table set last_check_dt = (select sysdate from dual)
where id = (select id from schema.email where current_email = '" . $email . "')";
Your SQL, when run through a OCI.. Don't need a semicolon as terminator.
This query is not returning any result as there seems to be an issue with the sql.
$sql = "select region_description from $DB_Table where region_id='".$region_id."' and region_status =(1)";
$res = mysql_query($sql,$con) or die(mysql_error());
$result = "( ";
$row = mysql_fetch_array($res);
$result .= "\"" . $row["region_description"] . "\"";
while($row = mysql_fetch_array($res))
{
echo "<br /> In!";
$result .= " , \"" . $row["region_description"] . "\"";
}
$result .= " )";
mysql_close($con);
if ($result)
{
return $result;
}
else
{
return 0;
}
region_id is passed as 1.
I do have a record in the DB that fits the query criteria but no rows are returned when executed. I beleive the issue is in this part ,
region_id='".$region_id."'
so on using the gettype function in my php it turns out that the datatype of region_id is string not int and thus the failure of the query to function as my datatype in my tableis int. what would be the way to get parameter passed to be considered as an int in php. url below
GetRegions.php?region_id=1
Thanks
Try it like this:
$sql = "SELECT region_description FROM $DB_Table WHERE region_id = $region_id AND region_status = 1"
The region_id column seems to be an integer type, don't compare it by using single quotes.
Try dropping the ; at the end of your query.
First of all - your code is very messy. You mix variables inside string with escaping string, integers should be passed without '. Try with:
$sql = 'SELECT region_description FROM ' . $DB_Table . ' WHERE region_id = ' . $region_id . ' AND region_status = 1';
Also ; should be removed.
try this
$sql = "select region_description from $DB_Table where region_id=$region_id AND region_status = 1";
When you are comparing the field of type integer, you should not use single quote
Good Luck
Update 1
Use this.. It will work
$sql = "select region_description from " .$DB_Table. " where region_id=" .$region_id. " AND region_status = 1";
You do not need the single quotes around the region id i.e.
$sql = "SELECT region_description FROM $DB_Table WHERE region_id = $region_id AND region_status = 1"
I am using this code so I can update a record in database:
$query = mysql_query("UPDATE article
SET com_count = ". $comments_count
WHERE article_id = .$art_id ");
My question is: How can I use variables in a MySQL UPDATE statement.
$query = mysql_query("UPDATE article set com_count = $comments_count WHERE article_id = $art_id");
You was messing up the quotes and concats.
You can use inline vars like the previous example or concat them like:
$query = mysql_query("UPDATE article set com_count = " . $comments_count . " WHERE article_id = " . $art_id);
You messed up on your " . pattern.
$query = mysql_query("UPDATE article set com_count = ". $comments_count . " WHERE article_id = " . $art_id . ");
Use apostrophes when using variables in a MySQL UPDATE statement:
$query = mysql_query("UPDATE article
SET com_count = '$comments_count'
WHERE article_id = '$art_id'");
Be careful about space and apostrophes.
I wrote this query:
$query = "UPDATE encodage_answer
SET Answer = geir
WHERE encodage_question_ID = 128
AND encodage_ID = 305
AND Extra = NULL";
$insert = mysql_query($query, $connection) or die(mysql_error());
But if I run this code I always get the same error:
Unknown column 'geir' in 'field list'
It's probably me but I think I am not saying geir is a column/field; what's the issue?
When I run this query directly in my PHPMyAdmin it works great.
Update: Full code:
The answer exists, $Extra variable is Null
$AnswerExists = answer_exists($Question_ID, $encodage_ID, $Extra);
if($AnswerExists <> ""){
if($Answer != NULL){
$correctAnswer = mysql_prep($Answer);
if($Extra != NULL){
$query = "UPDATE `encodage_answer` SET `Answer` = '" . mysql_prep($Answer) . "' WHERE `ID` = '" . $AnswerExists . "'";
$insert = mysql_query($query, $connection) or die(mysql_error());
$query2 = "UPDATE `encodage_answer` SET `Extra` = '" . $Extra . "' WHERE `ID` = '" . $AnswerExists . "'";
$insert = mysql_query($query2, $connection) or die(mysql_error());
}else{
$querytest = "UPDATE `encodage_answer` SET Answer = " . $Answer . " WHERE ID = " . $AnswerExists;
$insert = mysql_query($querytest, $connection) or die(mysql_error());
}
}
}
function answer_exists($Question_ID, $encodage_ID, $Extra){
global $connection;
$trfa = false;
echo $Question_ID . " - " . $encodage_ID . "<br />";
if($Extra <> ""){
$query = "SELECT *
FROM encodage_answer
WHERE encodage_ID = {$encodage_ID} AND encodage_question_ID = {$Question_ID} AND Extra = {$Extra}";
}else{
$query = "SELECT *
FROM encodage_answer
WHERE encodage_ID = {$encodage_ID} AND encodage_question_ID = {$Question_ID}";
}
Try putting single quotes around geir. By not quoting the string you want to set the column to, the SQL backend thinks you want to set the value of the Answer column to the value of the geir column. Since the geir column doesn't exist in your table, it throws an error.
Edit: I suspect that PHPMyAdmin has some kind of SQL statement filtering to catch cases like this, and automatically puts quotes around the string for you.
Thanks for the help to everyone! I'm changing all queries to a safer format! SQL-Injection treats are no longer an issue! Thanks for the tip!
Concerning my question:
I'am a complete idiot! After searching for a solution for 20 hours I found my error! The error was for another query. I'm very sorry for wasting your time but I'm a newbie (ergo, the sql-injection issue), so I hope I am allowed to make a few mistakes.
Thanks
Jens