Php / sql更新仅在cookie是数字时才起作用，而不是在它的文本时

Question

first time posting here.

I'm incredibly new (first day) to using php/mysql. I've managed to write something that displays a value from the database however I'm having a little trouble with allowing the user to edit that value. I've got a form that displays the current value in the database (all varchars) and then allows them to edit it however when i press submit it only actually updates it correctly if the cookie "username" used in the sql contains a number not when it's text...

mysqli_query($con,"UPDATE Customers SET password='".$_POST[password]."' WHERE email=$_COOKIE[username]");

like if cookie[username] contains 123 it will allow me to update other fields relating to it such as "name"/ "address" etc correctly

however if cookie[username] contains any text at all such as "hi" or "food123"it will just stay the same once submit is pressed and I'm not sure why..

Does anyone know what going wrong and why it works for numbers but not for text? Also i wouldn't mind if you could dumb down any help by a considerable amount as i will get lost by any level of complexity... If you need any additional info about my problem just let me know, thanks for any help.

Answer 1

Maybe this help:

mysqli_query($con,"UPDATE Customers SET password='" . $_POST['password'] . "' WHERE email='" . $_COOKIE['username'] . "'");

I just add single quotes so that the query might read the $_COOKIE[username] as string, So that either number or text would be accepted.

Keep in mind that using this code, your application may suffer SQL injection.