SRL Archive - Web Development

Can anybody help me get rid of this error? The problem is wit hthe $_POST bit.. something to do with quotes i think.
'Parse error: syntax error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING in /mnt/w0906/d42/s05/b02b2d42/www/scaralex.com/test/insert.php on line 9'

Heres the code.
[PHP]
<?php
$con = mysql_connect("localhost","","");
if (!$con)
{
die('Could not connect: ' . mysql_error());
}
mysql_select_db("d60385032", $con);

mysql_query("UPDATE randoms Info SET mime = $_POST['mime']
WHERE name = 'blah'");
?>

[/PHP]

From: ~alex~
Can anybody help me get rid of this error? The problem is wit hthe $_POST bit.. something to do with quotes i think.
'Parse error: syntax error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING in /mnt/w0906/d42/s05/b02b2d42/www/scaralex.com/test/insert.php on line 9'

Heres the code.
[php]
<?php
$con = mysql_connect("localhost","","");
if (!$con)
{
die('Could not connect: ' . mysql_error());
}
mysql_select_db("d60385032", $con);

mysql_query("UPDATE randoms Info SET mime = '" . $_POST['mime']."'
WHERE name = 'blah'");
?>

[/php]

always escape your qoutes when adding varables its a good habbit.You can also usea {} bracket to tell php theres a var but itwont work with a array inside a qoute


Also you should sngle qouteyour mysql querrys ie SET this ='that'

its more secure against SQL-Injection.

o one more thing, never accept user input as sql ready.You should use a cleaner like mysql_escape_string or something. Or verify its a number for ints like $var=$_POST['var'] + 0;

Just some tips for safer/proper php

thanks its working great now :)