mysql - Can't update sql through php -

$settings = parse_ini_file("settings.ini");  $conn = new mysqli($settings[servername],$settings[username],$settings[password], $settings[dbname]); $height = $_post['heightft'] * 12 + $_post['heightin']; if($conn->connect_error) {     die("connection failed: " . $conn->connect_error); } if(isset($_cookie['user'])) { list($currentfname, $currentlname) = explode(",", $_cookie['user']);  } $newfname = $_post['fname']; $newlname = $_post['lname']; $newage = $_post['age']; $newweight = $_post['weight']; $newheight = $_post['height']; $newsex = $_post['sex']; $sql = "update $settings[usertable] set fname = $newfname, lname = $newlname, age = $newage, weight = $newweight, height = $newheight, sex = $newsex fname = $currentfname , lname = $currentlname"; $retval = mysql_query($sql, $conn); if(!$retval) {     die("could not update data: " .  print_r($_post) );     //die("could not update data: " . mysql_error()); } echo "successful update"; 

this isn't working , don't know how troubleshoot it. code shows array ( [fname] => test [lname] => testing [age] => 25 [weight] => 199 [sex] => male [heightft] => 5 [heightin] => 7 ) not update data: 1

with

//die("could not update data: " . print_r($_post) ); die("could not update data: " . mysql_error());

it shows

could not update data:

is there anywhere php shows errors. when goes wrong in code white screen , have figure out issue through trial , error failed load resource: server responded status of 500 (internal server error)

you're mixing mysqli , mysql interface calls. doesn't work.

we see mysqli connection being created...

$conn = new mysqli( 

but see calls mysql_ interface function.

$retval = mysql_query( 

don't that. doesn't doesn't work. use mysqli_ functions.

so, fix first.

---

for debugging sql, echo out $sql before submit database. (make sure string you're sending sql statement want execute.)

also, incorporating potentially unsafe values (such values of variables $_get or $_post) leads sql injection vulnerabilities. values incorporated text of sql statement must escaped. see mysqli_real_escape_string. that's not sufficient guarantee code isn't still vulnerable sql injection.

a better pattern use prepared statements bind placeholders.

---

this isn't right.

if $newfname fred , $newlname flintstone

then this:

$sql = "update $settings[usertable] set fname = $newfname, lname = $newlname, ..."; 

or might need this:

$sql = "update " . $settings[usertable] . " set fname = $newfname, lname = $newlname, ..."; 

evaluates

 update mytable set fname = fred, lname = flintstone, ... 

mysql going balk @ that, because string literals should enclosed in single quotes:

 update mytable set fname = 'fred', lname = 'flintstone', ...                             ^    ^          ^          ^ 

if $newlname o'reilly, mysql going balk, he's going see string literal 'o' followed mysql doesn't understand...

 update mytable set fname = 'fred', lname = 'o'reilly', ...                                                ^^^^^^  

to run correctly, need escape single quote inside value single quote, our sql statement looks this:

 update mytable set fname = 'fred', lname = 'o''reilly', ...                                               ^^ 

the 2 single quotes inside string literal interpreted (by mysql) 1 single quote. value stored in column (assuming statement succeeds of course), wanted: o'reilly

you muck escaping values, much better pattern prepared statements bind placeholders...

 $sql = "update mytable set fname= ? ,lname = ?, ... ";   $stmt = $dbh->prepare($sql);  $stmt->bind_param("ss",$newfname,$newlname);  $stmt->execute(); 

reference: http://php.net/manual/en/mysqli-stmt.bind-param.php