Hi, please take a look at my code and advise what's wrong. Following is an error message pertaining to the code that follows: ----------------------------------------------------- Update query failed: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE acctno='xxx-xxx-xxxx'' at line 5 ----------------------------------------------------- following is the php document code ----------------------------------------------------- <html><head> <!--when the paidamt is keyed in, the current date & paid code are autoinserted--> <script type="text/javascript" src="payment.js"></script> <!--<script type="text/javascript"> window.google_analytics_uacct = "UA-256751-2"; </script> <script type="text/javascript"> window.google_analytics_uacct = "UA-256751-2"; </script>--> </head><body bgcolor="#ccffff"><b><center> <?php // error_reporting(0); error_reporting(E_ALL ^ E_NOTICE); mysql_connect('localhost','root','my_password'); mysql_select_db('homedb') or die( "Unable to select database"); if(!empty($_POST["submit"])) { $acctno = $_POST['acctno']; $query="SELECT * FROM oocust Where acctno='$acctno'"; $result=mysql_query($query); if(mysql_num_rows($result)) { echo date('m/d/y'); echo "<form action='#' method='post'>Invoice Payment :<br /><br /> <table cellspacing=0 cellpadding=0 border=1> <th colspan=4></th> <th colspan=2>amounts</th> <tr> <th>check#</th> <th>acct#</th> <th>Name</th> <th>Descr</th> <th>Paid</th> <th>Due</th> <th>Date Paid</th> <th>pd</th> </tr>"; while($row = mysql_fetch_assoc($result)) { echo "<tr> <td><input type='text' size=5 name='checkno' value='" . $row['checkno'] . "' ></td> <td><input type='text' readonly size=15 name='acctno' value='" . $row['acctno'] . "' ></td> <td><input type='text' readonly size=25 name='bname' value='" . $row['bname'] . "'></td> <td><input type='text' readonly size=25 name='purpose' value='" . $row['purpose'] . "'></td> <td><input type='text' size=7 id='paidamt' name='paidamt' value='" . $row['paidamt'] ."' onBlur='calculate_paid(this)'></td> <td><input type='text' size=7 id='amtdue' name='amtdue' value='" . $row['amtdue'] . "'></td> <td><input type='text' size=10 id='datepaid' name='datepaid' value='" . $row['datepaid'] . "'></td> <td><input type='text' size=1 id='pd' name='pd' value='" . $row['pd'] . "' ></td> </tr>"; } echo "</table> <input type='submit' name='update' value='make payment' /> </form>"; } else{echo "invalid entry for account# $acctno.<br />Select another?<br />";} } if(!empty($_POST["update"])) { $sql = "UPDATE oocust SET amtdue = '" . mysql_real_escape_string($_POST['amtdue']) . "', datepaid = '" . mysql_real_escape_string($_POST['datepaid']) . "', pd = '" . mysql_real_escape_string($_POST['pd']) . "', WHERE acctno='".$_POST["acctno"]."'"; mysql_query($sql) or die("Update query failed: " . mysql_error()); echo "Record for acct# ".$_POST["acctno"]." has been updated"; } ?> <form method="post" action="#"> <br /> <input type="text" name="acctno"/> <p> <input type="submit" name="submit" value="select acct#."/><p> </form> </body></html> ---------------------------------------------------- following is the payment.js - the if statement doesn't work ? ---------------------------------------------------- function $_(IDS) { return document.getElementById(IDS); } function calculate_paid() { var pd = document.getElementById("pd"); var datepaid = document.getElementById("datepaid"); var paidamt = document.getElementById("paidamt"); var amtdue = document.getElementById("amtdue"); var shipamt = document.getElementById("shipamt"); var dateNow = new Date var dayNow = dateNow.getDate(); var datePaid = (dateNow.getMonth()+1)+"/"+dateNow.getDate()+"/"+dateNow.getFullYear(); datepaid.value = datePaid; amtdue.value = parsefloat(amtdue.value) + parsefloat(shipamt.value) - parsefloat(paidamt.value); // ********************* if (amtdue.value=="0") { pd.value = "P"; } //******************** }
Try: $sql = "UPDATE `oocust` SET `amtdue` = '" . mysql_real_escape_string($_POST['amtdue']) . "', `datepaid` = '" . mysql_real_escape_string($_POST['datepaid']) . "', `pd` = '" . mysql_real_escape_string($_POST['pd']) . "' WHERE `acctno`='".$_POST["acctno"]."'"; PHP: NOTE: The issue I believe is an extra comma at the end of the line starting `pd` = In the WHERE clause you pass $_POST["acctno"], this could open you up to a SQL injection attack The mysql_ functions are deprecated