MySQL语法错误 - 靠近''第1行php

Question

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1

That what I getting error right now. I searched in internet and I can not seem to find it. Others said it's '' in variable ('$order_id') but it didn't solve the error.

When I click Accept button which is submitAccept then it will pop up a message "Order Accepted" BUT instead of that it pops up the aformentioned error. How do I fix this?

Here my sql code:

<?php
if(isset($_POST['submitDelivered'])){  
  $order_id = trim(addslashes($_POST['t_order_id']));
  $query = "UPDATE order_tbl SET `order_status`='Delivered' WHERE `order_id` = $order_id";
  if (mysqli_query(connection2(), $query)) { 
         mysqli_query(connection2(), "COMMIT");
         $_SESSION['message'] = "Order Delivered"; } 
         else { 
         $_SESSION['message'] = mysqli_error(connection2());
         mysqli_query(connection2(), "ROLLBACK");
         }
  }

  if(isset($_POST['submitAccept'])){  
  $order_id = trim(addslashes($_POST['t_order_id']));
  $query = "UPDATE order_tbl SET `order_status`='Accepted' WHERE `order_id` = $order_id";
  if (mysqli_query(connection2(), $query)) { 
         mysqli_query(connection2(), "COMMIT");
         $_SESSION['message'] = "Order Accepted"; } 
         else { 
         $_SESSION['message'] = mysqli_error(connection2());
         mysqli_query(connection2(), "ROLLBACK");
         }
  }      

  if(isset($_POST['submitCancel'])){  
  $order_id = trim(addslashes($_POST['t_order_id']));
  $query = "UPDATE order_tbl SET `order_status`='Cancelled' WHERE `order_id` = $order_id";
  if (mysqli_query(connection2(), $query)) { 
         mysqli_query(connection2(), "COMMIT");
         $_SESSION['message'] = "Order Cancelled"; } 
         else { 
         $_SESSION['message'] = mysqli_error(connection2());
         mysqli_query(connection2(), "ROLLBACK");
         }
  }      
  ?>

Answer 1

Are you certain that MySQL error is derived from the PHP you display in the question? What was the value of $order_id when you got that error?

  $query = "UPDATE order_tbl SET `order_status`='Delivered' WHERE `order_id` = $order_id";
  $query = "UPDATE order_tbl SET `order_status`='Accepted' WHERE `order_id` = $order_id";
  $query = "UPDATE order_tbl SET `order_status`='Cancelled' WHERE `order_id` = $order_id";

There is no obvious SQL syntax error in any of the 3 queries shown UNLESS something bad has been put into $order_id.

Please note I am not commenting on your PHP as I'm not expert is that, but I do know you should be using prepared statements (and many have advised already).