更新电子邮件地址表问题

Question

I'm trying to update a email field in Mysql through php. i keep getting this error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '@yahoo.com,

The cell in Mysql is varchar(100). The e-mail addres is typed in from a text box.

$insert_fbacc="UPDATE jos_users SET email=".$_POST['email']", WHERE id='$user->id'";

with the previous code, mysql updates only half of the email address, only the @yahoo.com part.

i tried to convert $_POST['email'] to string and the result is the error i wrote.

EDIT:

Thanks guys, you're great!

I found out what it was... bad syntax and forgot to escape.

Thanks a lot!

Answer 1

Actually, you seem to have a syntax error in the code (no dot after $_POST['email']).

And the variable itself isn't surrounded by quotes. It should be:

$insert_fbacc="UPDATE jos_users SET email='{$_POST['email']}', WHERE id='$user->id'";

Also, don't forget to escape the variable using mysql_real_escape_string:

$_POST['email'] = mysql_real_escape_string($_POST['email']).