[PHP] Echo in an echo?

[CS-dude]

Hey,

Can't tell if this was ever fixed. So will post a quick solution. When echoing/setting a variable to text inside double quotes you can easily add in variables by simply using {$myvar} directly in the text.
The errors are most likely due to a missing character escape. A solution to that would be make use of a more advanced method of creating a string. Rather than double quotes use:

ecgo <<<EOF

text you 'want' "here"

EOF;

The advantage of EOF tags is you don't have to worry about escaping any quotation marks

Finally the problem with your mysql is that your using the syntax to add a new row. Not to update one
Update syntax should be as follows

UPDATE table_name SET column1=value, column2=value2 WHERE some_column=some_value

assuming you are updating an existing row. If you trying to create a new row though, your syntax is correct, but you should be using the command "INSERT INTO" rather than UPDATE.

Hope that helps.
CS-Dude

[Decode]

Just put {} around the var so it would be like {$database['username']}

[Agnostic Bear]

Hey,

Can't tell if this was ever fixed. So will post a quick solution. When echoing/setting a variable to text inside double quotes you can easily add in variables by simply using {$myvar} directly in the text.
The errors are most likely due to a missing character escape. A solution to that would be make use of a more advanced method of creating a string. Rather than double quotes use:

ecgo <<<EOF

text you 'want' "here"

EOF;

The advantage of EOF tags is you don't have to worry about escaping any quotation marks

Finally the problem with your mysql is that your using the syntax to add a new row. Not to update one
Update syntax should be as follows

UPDATE table_name SET column1=value, column2=value2 WHERE some_column=some_value

assuming you are updating an existing row. If you trying to create a new row though, your syntax is correct, but you should be using the command "INSERT INTO" rather than UPDATE.

Hope that helps.
CS-Dude

They're called HEREDOC tags and can be anything, i.e

$what = <<<HELLO

HELLO;

$what = <<<HURFDURF

HURFDURF; 

The only thing that you need to know is that the HELLO; part must be at the very start of the line, there can't be anything in front of it.

[wsg14]

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ' nickname=, location=, email=, gender=, bio=, favouritemovie=, favouritemusic=, ' at line 1

    mysql_query("INSERT INTO users SET firstname={$fname}, lastname={$lname}, nickname={$nname}, location={$location}, email={$email}, gender={$gender}, bio={$bio}, favouritemovie={$fmovies}, favouritemusic={$fmusic}, favouritebooks={$fbooks} WHERE username={$grab_username}") or die(mysql_error()); 

[Dentafrice]

no dude.. for INSERT you use:

INSERT INTO `bla` (`ha`, `ha`) VALUES('$variable', '$bal')

for UPDATE:

UPDATE `bla` SET `field`='$value', `bla`='$bla'

[wsg14]

oh, forgot to change it to update. however once I changed it to update I still get the error.

[Dentafrice]

because you need to do.. `field`='$value'

you don't need {}'s and you need to have ''s around the value..

[wsg14]

    mysql_query("UPDATE `users` SET `firstname`='$fname', `lastname`='$lname', `nickname`='$nname', `location`='$location', `email`='$email', `gender`='$gender', `bio`='$bio', `favouritemovie`='$fmovies', `favouritemusic`='$fmusic', `favouritebooks`='$fbooks' WHERE `username`='$grab_username'") or die(mysql_error()); 

Thanks for that, it got rid of the error. I know I'm a complete noob at PHP but hopefully I'll improve. Anyway, that code doesn't update the database.

[Dentafrice]

Are you sure the query is actually being executed? Post your full code.

[wsg14]

<?php 

$fname = $_POST['firstname'];
$lname = $_POST['lastname'];
$nname = $_POST['nickname'];
$location = $_POST['location'];
$email = $_POST['email'];
$gender = $_POST['gender'];
$bio = $_POST['bio'];
$fmovies = $_POST['favmovies'];
$fmusic = $_POST['favmusic'];
$fbooks = $_POST['favbooks'];
    
$fname = htmlspecialchars($fname);
$lname = htmlspecialchars($lname);
$nname = htmlspecialchars($nname);
$location = htmlspecialchars($location);
$email = htmlspecialchars($email);
$gender = htmlspecialchars($gender);
$bio = htmlspecialchars($bio);
$fmovies = htmlspecialchars($fmovies);
$fmusic = htmlspecialchars($fmusic);
$fbook = htmlspecialchars($fbooks);

$currentpassword = mysql_query("SELECT `password` FROM `users` WHERE `username` = '$grab_username'");
$newpassword = $_POST['newpassword'];
$newpassword = md5($newpassword);

$query = mysql_query("SELECT * FROM `users` WHERE `username` = '$grab_username'");
$value = mysql_fetch_array($query);

if($_GET['do'] == update){
    mysql_query("UPDATE `users` SET `firstname`='$fname', `lastname`='$lname', `nickname`='$nname', `location`='$location', `email`='$email', `gender`='$gender', `bio`='$bio', `favouritemovie`='$fmovies', `favouritemusic`='$fmusic', `favouritebooks`='$fbooks' WHERE `username`='$grab_username'") or die(mysql_error());

    echo "congrats, you have updated your info.";
    echo "<meta HTTP-EQUIV=\"refresh\" CONTENT=\"5\"; URL=\"index.php\">";
} 

if($_GET['do'] == updatepw){
    if($currentpassword != $value['password']){
        echo "sorry, but the password you entered does not match your current one.";
    } else {
        mysql_query("UPDATE `users` WHERE `password` = '$newpassword'");
        echo "congrats, you have updated your password.";
        echo "<meta HTTP-EQUIV=\"refresh\" CONTENT=\"5\"; URL=\"index.php\">";
    }
}
else {
?>

<form action="?do=update" method="post">
first name: <input type="text" name="firstname" value="<?php echo $value['firstname'] ?>" /><br />
last name: <input type="text" name="lastname" value="<?php echo $value['lastname'] ?>" /><br />
nick name: <input type="text" name="nickname" value="<?php echo $value['nickname'] ?>" /><br />
location: <input type="text" name="location" value="<?php echo $value['location'] ?>" /><br />
email: <input type="text" name="email" value="<?php echo $value['email'] ?>" /><br />
gender: <input type="radio" name="gender" value="male" /> male <input type="radio" name="gender" value="female" /> female<br />
bio: <input type="text" height="200px" width="300px" name="bio" value="<?php echo $value['bio'] ?>" /><br />
fav movies: <input type="text" height="200px" width="300px" name="favmovies" value="<?php echo $value['favmovies'] ?>" /><br />
fav music: <input type="text" height="200px" width="300px" name="favmusic" value="<?php echo $value['favmusic'] ?>" /><br />
fav books: <input type="text" height="200px" width="300px" name="favbooks" value="<?php echo $value['favbooks'] ?>" /><br />
<input type="submit" value="update profile" />
</form><br />
<br />
want to change your password?
<form action="?do=updatepw" method="post">
current password: <input type="password" name="currentpassword" /><br />
new password: <input type="password" name="newpassword" /><br />
<input type="submit" value="update password" />
</form>

<?php
}
?>

The config include, session_start and ob_start are all at the top of the page, so they're not in that code.