Simple PHP Problem

Hi,

I currently have this:

mysql_query("UPDATE drink SET `count=count+1` WHERE id = '$_GET["id"]'");

PHP:

What is wrong with it?

Thanks

Edit: This has been fixed

 

Try this:

mysql_query("UPDATE drink SET `count=count+1` WHERE id = '.$_GET["id"].'");

PHP:

 

^^ This won't work either.

and this is a double post.

http://forums.digitalpoint.com/showthread.php?t=510329

 

Ah yes. Missed the quotes. I mainly use single-quotes.

And I see its fixed already.

 

Wow this line of code is ripe for being exploited. You're taking input directly from a get which isn't good. This code can possibly be used for sql injection. Vet the input before you use it.

$id = mysql_real_escape_string(stripslashes($_GET["id"]));
mysql_query("UPDATE drink SET count = count + 1 WHERE id = '$id'");

PHP:

Never trust input from a user.


Zen

 

This won't work either because "count" is a registered keyword, and needs to be enclosed in backticks.

 

This will get rid of the count problem

$id = mysql_real_escape_string(stripslashes($_GET["id"]));
mysql_query("UPDATE drink SET drink.count = drink.count + 1 WHERE drink.id = '$id'");

PHP: