sql update error afer registration - php

Question

After creating a form for user registration, I want to add groups.
Now I first tried editing the prepared statement but that did not work, so I tried this:
<?php
error_reporting(E_ALL); ini_set('display_errors', 1);
include('connect.php');
// If the values are posted, insert them into the database.
if (isset($_POST["username"]) && isset($_POST["password"])){
$username = $_POST["username"];
$email = $_POST["email"];
$password = $_POST["password"];
$epassword = hash("sha512", $password);
$group = 'user';
$query1 = "SELECT * FROM `user` WHERE email='$email'";
$result = mysqli_query($connection, $query1) or die(mysqli_error($connection));
$count = mysqli_num_rows($result);
if ($count == 1){
$msg1 = "Dit E-mailadres is al in gebruik voor een andere gebruiker.";
}else{
$query = "SELECT * FROM `user` WHERE username='$username'";
$result = mysqli_query($connection, $query) or die(mysqli_error($connection));
$count = mysqli_num_rows($result);
if ($count == 1){
$msg2 = "Deze gebruikersnaam is al in gebruik.";
}else{
$stmt = $connection->prepare("INSERT INTO `user` (username,password,email) VALUES(?,?,?)");
$stmt->bind_param("sss", $username, $epassword, $email);
$stmt->execute();
$msg = "De gebruiker is aangemaakt.";
$sql2 = "UPDATE user
SET group = $group
WHERE username = $username" ;
$retval = mysqli_query( $connection, $sql2);
if(! $retval )
{
die('Could not update data: ' . mysqli_error($connection));
}
}
}
}
?>
and now it is creating the user (with no group) after showing the following error:
Could not update data: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'group = user WHERE username = test' at line 1
could you help me with this?
thanks to juergen d this is the working code:
<?php
error_reporting(E_ALL); ini_set('display_errors', 1);
include('connect.php');
// If the values are posted, insert them into the database.
if (isset($_POST["username"]) && isset($_POST["password"])){
$username = $_POST["username"];
$email = $_POST["email"];
$password = $_POST["password"];
$epassword = hash("sha512", $password);
$modus = "user";
$query1 = "SELECT * FROM `user` WHERE email='$email'";
$result = mysqli_query($connection, $query1) or die(mysqli_error($connection));
$count = mysqli_num_rows($result);
if ($count == 1){
$msg1 = "Dit E-mailadres is al in gebruik voor een andere gebruiker.";
}else{
$query = "SELECT * FROM `user` WHERE username='$username' ";
$result = mysqli_query($connection, $query) or die(mysqli_error($connection));
$count = mysqli_num_rows($result);
if ($count == 1){
$msg2 = "Deze gebruikersnaam is al in gebruik.";
}else{
$stmt = $connection->prepare("INSERT INTO `user` (username,password,email) VALUES(?,?,?)");
$stmt->bind_param("sss", $username, $epassword, $email);
$stmt->execute();
$msg = "De gebruiker is aangemaakt.";
$sql2 = "UPDATE `user`
SET `modus` = '$modus'
WHERE username = '$username'";
$retval = mysqli_query( $connection, $sql2);
if(! $retval )
{
die('Could not update data: ' . mysqli_error($connection));
}
}
}
}
?>

Answer 1

group is a reserved word and needs to be escaped with backticks.
UPDATE user
SET `group` = '$group'
WHERE username = '$username'"
And as others already mentioned - put your strings in quotes or better look into Prepared Statements.

Answer 2

You need to wrap strings in apostrophes, just like you did in one of your previous queries; example:
$sql2 = "UPDATE `user` SET `group` = $group WHERE username = '$username'";
Also, as per juergen d's answer, you need to enclose the group column in backticks, as it is a reserved word.

Answer 3

I don't know whether mysql allow you to use "group" as column name, but the most obvious error is you need wrap the group value with double quotes: set group="$group"

Answer 4

try:
$sql2 = "UPDATE `user`
SET `group` = '$group'
WHERE `username` = '$username'";