如何使用php减去sql

Question

I would like to subtract the quantity in my database using php

part of HTML code

<label class="control-label">Medicine Name</label>
<input type="text" class="form-control" name="medname">
<label class="control-label">Quantity</label>
<input type="text" class="form-control input-sm" name="quantity">
<button type="submit" class="btn" style="background:#830006;" name="submit1">OK</button>

PHP

if (isset($_POST['submit1'])) {
  $mediname = pg_escape_string($_POST['medname']);
  $tits = pg_escape_string($_POST['quantity']);

  $quirt = ("UPDATE medicine_invent set med_stock = med_stock - $tits where med_name = $mediname");
  $sq = pg_query($quirt);
}

please help me. i'm still a beginner at php. Thanks a lot.

Answer 1

if the $mediname is string you should use quote around this var (string var)

 ("UPDATE medicine_invent 
       set med_stock = med_stock - $tits 
       where med_name = '$mediname'");

Anyway you should not use php var directly in your sql code for avoid sqlinjection risk .. check for you framework/dbdriver the correct use of parametrized query and pass the value you need using binding param features