mySQL查询语句

Question

I have an error on $sql statement on output.

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1" This is referring to the UPDATE users SET activationkey statement.

  $query = "SELECT * FROM users"; 

    $result = mysql_query($query) or die(mysql_error());

      while($row = mysql_fetch_array($result)){

if ($queryString == $row["activationkey"]){
 $sql="UPDATE users SET activationkey = '', status='activated' WHERE (id = $row[id])";

  if (!mysql_query($sql)) { *die('Error: in activation' . mysql_error());} 
}
 }

I don't know why that syntax is wrong.

Answer 1

$query = "UPDATE `users` SET `activationkey` = '', status='activated' WHERE `id` = '$row['id']'";

Tip: I suggest securing your id because sql injection can be done in that query. By that I mean instant of saying WHERE id = '$row['id']', use WHERE id = (int) ($row['id']), This make sure only an integer is given in that query. If it was a string us mysql_real_escape_string($row['string'])