Trouble with update

Hi, please take a look at my code and advise what’s wrong. Following is an error message pertaining to the code that follows:

Update query failed: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘WHERE acctno=‘xxx-xxx-xxxx’’ at line 5


following is the php document code

<html><head>
<!--when the paidamt is keyed in, the current date & paid code are autoinserted-->
<script type="text/javascript" src="payment.js"></script>
<!--<script type="text/javascript">
window.google_analytics_uacct = "UA-256751-2";
</script>
<script type="text/javascript">
window.google_analytics_uacct = "UA-256751-2";
</script>-->
</head><body bgcolor="#ccffff"><b><center>
<?php
// error_reporting(0);
error_reporting(E_ALL ^ E_NOTICE);
mysql_connect('localhost','root','my_password');
mysql_select_db('homedb') or die( "Unable to select database");
if(!empty($_POST["submit"]))
{
$acctno = $_POST['acctno'];
$query="SELECT * FROM oocust Where acctno='$acctno'";
$result=mysql_query($query);
if(mysql_num_rows($result))
{
echo date('m/d/y');
echo "<form action='#' method='post'>Invoice Payment :<br /><br />
<table cellspacing=0 cellpadding=0 border=1>		
<th colspan=4></th>
<th colspan=2>amounts</th>
<tr>
<th>check#</th>		
 <th>acct#</th>
<th>Name</th>		
<th>Descr</th>
<th>Paid</th>
<th>Due</th>
<th>Date Paid</th>
<th>pd</th>
   </tr>";	
while($row = mysql_fetch_assoc($result))
   {
echo "<tr>
<td><input type='text' size=5 name='checkno' value='" . $row['checkno'] . "' ></td>
<td><input type='text' readonly size=15 name='acctno' value='" . $row['acctno'] . "' ></td>
<td><input type='text' readonly size=25 name='bname' value='" . $row['bname'] . "'></td>
<td><input type='text' readonly size=25 name='purpose' value='" . $row['purpose'] . "'></td>

<td><input type='text' size=7 id='paidamt' name='paidamt' value='" . $row['paidamt'] ."'
onBlur='calculate_paid(this)'></td>

<td><input type='text' size=7 id='amtdue' name='amtdue' value='" . $row['amtdue'] . "'></td>
<td><input type='text' size=10 id='datepaid' name='datepaid' value='" . $row['datepaid'] . "'></td>
<td><input type='text' size=1 id='pd' name='pd' value='" . $row['pd'] . "' ></td>	
      </tr>";
}
echo "</table>
<input type='submit' name='update' value='make payment' />
</form>";
}
 else{echo "invalid entry for account# $acctno.<br />Select another?<br />";}
}
if(!empty($_POST["update"]))
{
$sql = "UPDATE oocust SET
  amtdue = '" . mysql_real_escape_string($_POST['amtdue']) . "',
 datepaid = '" . mysql_real_escape_string($_POST['datepaid']) . "',
 pd = '" . mysql_real_escape_string($_POST['pd']) . "',
      WHERE acctno='".$_POST["acctno"]."'";
mysql_query($sql) or die("Update query failed: " . mysql_error());
echo "Record for acct# ".$_POST["acctno"]." has been updated";
}
?>
<form method="post" action="#">
<br />
<input type="text" name="acctno"/> <p>
<input type="submit" name="submit" value="select acct#."/><p>
</form>

</body></html>

following is the payment.js - the if statement doesn’t work ?

function $_(IDS) { return document.getElementById(IDS); }
function calculate_paid()
  {
   var pd = document.getElementById("pd");
   var datepaid = document.getElementById("datepaid");
   var paidamt = document.getElementById("paidamt");
   var amtdue = document.getElementById("amtdue");
   var shipamt = document.getElementById("shipamt");
   var dateNow = new Date
   var dayNow = dateNow.getDate();
   var datePaid = (dateNow.getMonth()+1)+"/"+dateNow.getDate()+"/"+dateNow.getFullYear();
datepaid.value = datePaid;
amtdue.value = parsefloat(amtdue.value) + parsefloat(shipamt.value) - parsefloat(paidamt.value);
// *********************
if (amtdue.value=="0")
  { pd.value = "P"; }
//********************
  }

Try this:



<?php 
  // error_reporting(0); 
  // error_reporting(E_ALL ^ E_NOTICE); 

error_reporting(-1); // Maximum errors
mysql_connect('localhost','root','my_password'); 
mysql_select_db('homedb') or die( "Unable to select database"); 

if(!empty($_POST["submit"])) 
{ 
   $acctno = isset($_POST['acctno']) ? $_POST['acctno'] : FALSE; // Ensure $acctno has a value
   if( ! $acctno)
   {
     echo 'Yes we have NO $acctno ???';
     die;
   }

   $query  = 'SELECT * FROM oocust Where acctno=" ' .$acctno .' " '; 
  $result=mysql_query($query); 
  if(mysql_num_rows($result)) 
  {  
    echo date('m/d/y');
    ...
    ...



You might also try escaping the post

$acctno = mysql_real_escape_string($_POST['acctno']);

You might need to bracket that variable because of the dashes.

$query="SELECT * FROM oocust Where acctno='{$acctno}'";

Duh… UPDATE…

You have a comma after pd = ‘" . mysql_real_escape_string($_POST[‘pd’]) . "’,

$sql = "UPDATE oocust SET
  amtdue = '" . mysql_real_escape_string($_POST['amtdue']) . "',
 datepaid = '" . mysql_real_escape_string($_POST['datepaid']) . "',
 pd = '" . mysql_real_escape_string($_POST['pd']) . "'
      WHERE acctno='".$_POST["acctno"]."'";

I’m sure you’ve heard it… Move away from mysql and don’t post directly to query.

yes and thanks. I’m trying absorb the info. it’s like comparing Cobol to Rpg