How to insert one value into a table while passing a variable to the SQL query using PHP

Question

I am trying to insert a new password into the password column of my users table. I am passing two variables to the SQL query, the new password and the user ID, but I cannot get it to work no matter what I do. Here is the SQL query:

$sql = "INSERT INTO cryptuser  WHERE userID ='" . $userid ."' (passwordnew)
                    VALUES ('$passwordnew')  ";

Here is my form:

<fieldset>

<legend>Change Password</legend>

<form action="changepass.php" method="POST">
        <label>Current Password :</label>
        <input type="password" name="password" /><br />
        <label>New Password :</label>
        <input type="password" name="passwordnew" /><br/>
        <label>Repeat New Password :</label>
        <input type="password" name="passwordnewRepeat" /><br/>
        <input class="signbutt" type="submit" value="Save"/><br />

</form>

Once I can change the password stored in the table, then I will create further SQL that will only change the password to the new value if the current password entered matches the existing password, then JavaScript to make sure the re-entered password matches the new password.

You need to use UPDATE. Please post the DB schema of that table. — Juanma
– Juanma, Commented Feb 23, 2012 at 15:40

mindandmedia · Accepted Answer · 2012-02-23 15:46:42Z

2

either you insert

$sql = "INSERT INTO cryptuser ( userID, password) VALUES ( 5, 's3cret')  ";

or you update

$sql = "UPDATE cryptuser  SET password='s3cr3t' where userID =5";

AND as always: WORD OF WARNING! do not use the posted strings and insert them directly into the database, because you open yourself up to sql injection attacks. you need to sanitize the strings. look up the terms for further instruction.

edit because of comment:

$sql = sprintf("UPDATE cryptuser  SET password='%s' where userID =%d" , $newpassword, $userId);

edited Feb 23, 2012 at 15:46

answered Feb 23, 2012 at 15:41

mindandmedia

6,8551 gold badge26 silver badges33 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

deucalion0 Over a year ago

Hi, I am taking the users ID from a session variable, it will be different for every user, so I cannot add a user ID manually to the query.

mishu Over a year ago

@deucalion0 you are missing the point.. you can use the variable.. but within an UPDATE statement

deucalion0 Over a year ago

You are right, I have been trying to do something completely wrong using INSERT instead of UPDATE. It now works, thanks you.

mishu · Accepted Answer · 2012-02-23 15:41:30Z

1

I think you should take a look at the sql manual.

First of all it sounds like you want to update a value but you are using INSERT. Look for the UPDATE statement

The second problem: INSERT with WHERE?

answered Feb 23, 2012 at 15:41

mishu

5,3971 gold badge24 silver badges41 bronze badges

Comments

Jeff Lambert · Accepted Answer · 2012-02-23 15:43:29Z

1

Try changing your SQL to this:

$sql = "INSERT INTO cryptuser(userID, passwordnew) 
        VALUES('$userid', '$passwordnew')";

Although, if this is an 'Update Password' form, it makes more sense to use a SQL UPDATE statement because the record in your table for the current user probably already exists...

$sql = "UPDATE cryptuser SET passwordnew = '$passwordnew' 
        WHERE userID = '$userid'";

I am assuming that you are already sanitizing the variables holding your values to prevent SQL Injection attacks. You should also look into using Prepared Statements

answered Feb 23, 2012 at 15:43

Jeff Lambert

24.7k4 gold badges72 silver badges98 bronze badges

Comments

Your Common Sense · Accepted Answer · 2012-02-23 15:43:35Z

0

this is wrong SQL problem, not inserting variable problem
the right order of the UPDATE query would be

UPDATE cryptuser SET passwordnew='passwordnew'  WHERE userID=1;

answered Feb 23, 2012 at 15:43

Your Common Sense

158k42 gold badges226 silver badges374 bronze badges

1 Comment

deucalion0 Over a year ago

I implemented your suggestion and it worked perfectly. Thank you for your help.

Collectives™ on Stack Overflow

How to insert one value into a table while passing a variable to the SQL query using PHP

4 Answers 4

3 Comments

Comments

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

3 Comments

Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related