I thought there was a way to do an update in the same style format as
an insert, meaning:
$result = mysql_query("UPDATE MyTables (Username, Password, Name,
BusinessName, Phone, Email, Website, Listing, County, Town, County2,
Town2, County3, Town3) values ('".$Username."',
'".$_SESSION['Rcrd']['Psswrd']."', '".$Name."', '".$BusinessName."',
'".$Phone."', '".$Email."', '".$Website."', '".$Listing."',
'".$HomeCounty."', '".$HomeTown."', '".$County2."', '".$Town2."',
'".$County3."', '".$Town3."') WHERE
Username='".$_SESSION['Rcrd']['Usernm']."' AND
Password='".$_SESSION['Rcrd']['Psswrd']."'");

Thanks
Mike

On 1/3/2012 11:16 PM, Michael Joel wrote:
[incorrect syntax snipped]

I think you need to check the manual. UPDATE and INSERT do not have the
same syntax.

El 04/01/2012 5:16, Michael Joel escribió/wrote:
Well, there's no need to guess, this is all documented:

UPDATE [LOW_PRIORITY] [IGNORE] table_reference
SET col_name1={expr1|DEFAULT} [, col_name2={expr2|DEFAULT}] ...
[WHERE where_condition]
[ORDER BY ...]
[LIMIT row_count]

http://dev.mysql.com/doc/refman/5.5/en/update.html

(... or your favourite SQL reference, the basic syntax belongs to the
standard.)

--
-- http://alvaro.es - Álvaro G. Vicario - Burgos, Spain
-- Mi sitio sobre programación web: http://borrame.com
-- Mi web de humor satinado: http://www.demogracia.com
--

�lvaro G. Vicario wrote:
The nice thing is that you can use the same syntax for an insert, which
means you can cut and paste the line and reuse it with minimal
modification, for that, as well...

I have to say that I nearly always use sprintf in PHP to set up the
query, as just a bit of extra precaution against SQL injection..

The difference between a guranteed numerical value using '%d' or '%f'
and simply using the global variables value, is not to be sneezed at..

On 04-01-2012 05:16, Michael Joel wrote:
And can tou share with us WHY you do think this is not possible?

Do you get an error? and if so, what error?
(and i'm talking about the error from MySQL, not any errors from PHP

--
Luuk

On Wed, 04 Jan 2012 10:57:35 +0000, The Natural Philosopher
<tnp (AT) invalid (DOT) invalid> wrote:

That offers no protection at all, not more than concatenating
stuff to a query string.
Best regards,
--
( Kees Nuyt
)
c[_]

Kees Nuyt wrote:
%d does not recognise punctuation

string concats do.

Simnce te easiets way to swl inject given that teh query is often of the
form

update....where id=3

its stops people hacking things to send you instead of '3' '3; drop
table customers'

or whatever...

On Jan 4, 4:16*am, Michael Joel <n... (AT) please (DOT) com> wrote:
You've got it the wrong way round. In MySQL it is possible to do an
INSERT using a similar format to an UPDATE. but the converse isn't
necessarily true.

And if you're building your string using double quotes, do yourself a
favour and dumb all the "."s, thus:

$result = mysql_query("UPDATE MyTables (Username, Password, Name,
BusinessName, Phone, Email, Website, Listing, County, Town, County2,
Town2, County3, Town3) values ('$Username',
"{$_SESSION['Rcrd']['Psswrd']}', '$Name', '$BusinessName',
'$Phone', '$Email', '$Website', '$Listing',
'$HomeCounty', '$HomeTown', '$County2', '$Town2',
'$County3', '$Town3') WHERE
Username='{$_SESSION['Rcrd']['Usernm']}' AND
Password='{$_SESSION['Rcrd']['Psswrd']}'");

But even better would be to format your query neatly!

On 1/6/2012 8:35 AM, Captain Paralytic wrote:
Paul, I know you were trying to be succinct in your posing, but your
example is very bad for security.

ALL strings need to use mysql_real_escape_string() to ensure characters
such as quotes (') (and others, depending on the charset) are handled
properly. More importantly, it prevents SQL injection attacks.

Additionally, numeric values need to be verified that they actually are
numeric before inserting, again to prevent SQL injection attacks.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex (AT) attglobal (DOT) net
==================

On 1/6/2012 8:35 AM, Captain Paralytic wrote:
I should also add that using bound parameters will prevent SQL injection.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex (AT) attglobal (DOT) net
==================