Error related to updating quantity in table - php

Question

I need your help to resolve this issue in my script as I am trying to
update a quantity of the product in products table based on
getting information via post from the first page.
Everything seems ok but the quantity is not getting updated in the table.
The table already had some quantity for this product.
Page 1:
$selectP="select prodid, prodname, prodtype from products where prodtype = 'BP'";
$result=mysql_query($selectP) or die (mysql_error());
echo "<form method=POST action=quantupdate.php>";
echo "<center><table border=1 cellpadding=5>";
echo "<tr><td>Select a Product to Update Quantity in Stock </td>";
echo "<td>";
echo "<select size=\"1\" name=\"product_selection\" id=\"product_selection\">";
echo "<option value=\"0\">- Product -</options>";
while($row = mysql_fetch_array($result)) {
echo "<option value='".$row['prodid']."'>".$row['prodname']."</option>";
}
echo "</select>";
echo "<tr><td>Select Quantity </td>";
echo "<td>";
echo "<select size=\"1\" name=\"pq\" id=\"pq\">";
echo "<option value=\"0\">Select Qty</options>";
echo "<option value=\"5\">5</options>";
echo "<option value=\"10\">10</options>";
echo "<option value=\"20\">20</options>";
echo "<option value=\"30\">30</options>";
echo "</select>";
echo "<tr><td><input type=submit name=submit id=submit value='Update Now'></td>";
echo "<td><input type=reset value='Clear Form'></td></tr>";
echo "</table></center>";
echo "</form>" ;
Page 2:
$bprod=$_POST['product_selection'];
$quantity=$_POST['pq'];
if(isset($_REQUEST['product_selection'])) {
$bprod=$_POST['product_selection'];
} else {
echo "Not Working???";//do something about it
}
$updatequantity="UPDATE products
SET prodquantity = ".$quantity." WHERE prodname = ".$bprod;
$exeupdatequantity=mysql_query($updatequantity);
Everything seems ok, no error message but table is not getting updated with the new quantity.
Please help.

Answer 1

It's problem with your update query. You try to update record by prodname, but you pass prodid to it, becouse $_POST['product_selection'] variable contains value of option, which in your case is prodid.
Also,
echo "<option value=\"0\">- Product -</options>";
should be
echo "<option value=\"0\">- Product -</option>";
Also, you should go with what Tomek said, and pass your values to query in apostrophes.
Ultimately, your query should be:
$updatequantity = "UPDATE products SET prodquantity = '".$quantity."' WHERE prodid = '".$bprod."';";

Answer 2

Fix your updating query:
$updatequantity="UPDATE products
SET prodquantity = '".$quantity."' WHERE prodname = '".$bprod."';";
You need to use quotes in strings in MySQL, otherwise they will be treated as column name.
And remember, that using unescaped values from $_POST / $_REQUEST / $_GET is potentially very unsafe.
Use for example mysql_escape_string to escape your values:
$quantity = mysql_escape_string($qunatity);
$bprod = mysql_escape_string($bprod);