您的SQL语法有错误; WHERE username ='115110030''在第1行

Question

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE username='115110030'' at line 1

I tried so hard but cant solve the problem, please help me solve this

---

<?php
if(isset($_POST['submit'])){

    $username       = $_SESSION['username'];
    $name           = $_POST['nama'];   
    $tempat_lahir   = $_POST['tempat_lahir'];   
    $tgl_lahir      = $_POST['tgl_lahir'];
    $gender         = $_POST['gender'];
    $alamat         = $_POST['alamat'];
    $telp           = $_POST['telp'];
    $email          = $_POST['email'];
    $image_name = $_FILES['file']['name'];
    $path  = "assets/img/photo/" . $image_name;
    $upload = move_uploaded_file($_FILES['file']['tmp_name'], $path);

    if (empty($image_name))
    {
        $update = mysql_query("UPDATE users SET name='$name', tempat_lahir='$tempat_lahir', tanggal_lahir='$tgl_lahir', gender='$gender', alamat='$alamat', telp='$telp', email='$email', WHERE username='$username'") or die(mysql_error());
        echo "<script>alert('Data Berhasil Di Update.'); window.location.assign('index.php');</script>";
    }
    else if(!empty($image_name))
    {
        $update = mysql_query("UPDATE users SET name='$name', tempat_lahir='$tempat_lahir', tanggal_lahir='$tgl_lahir', gender='$gender', alamat='$alamat', telp='$telp', email='$email', image='$image_name' WHERE username='$username'") or die(mysql_error());
        echo "<script>alert('Data Berhasil Di Update.'); window.location.assign('index.php');</script>";
    }

}
?>

---

Answer 1

Replace this:

$update = mysql_query("UPDATE users SET name='$name', tempat_lahir='$tempat_lahir', tanggal_lahir='$tgl_lahir', gender='$gender', alamat='$alamat', telp='$telp', email='$email', WHERE username='$username'") or die(mysql_error());

with this:

$update = mysql_query("UPDATE users SET name='$name', tempat_lahir='$tempat_lahir', tanggal_lahir='$tgl_lahir', gender='$gender', alamat='$alamat', telp='$telp', email='$email' WHERE username='$username'") or die(mysql_error());

Also, you should resolve your SQL Injections issues: http://php.net/manual/en/security.database.sql-injection.php