Error in SQL UPDATE query

Question

$result = mysql_query("UPDATE categories
        SET cd_title='$docuTitle' , cd_link='$linkTitle'
        WHERE c_name='$catID'");

What is wrong with this update query?

Answer 1

I would change the query to this, to avoid errors if input contains apostrophes:

$result = mysql_query(
    "UPDATE categories SET
         cd_title='" . mysql_real_escape_string($docuTitle) . "',
         cd_link='" . mysql_real_escape_string($linkTitle) . "'
     WHERE
         c_name='" . mysql_real_escape_string($catID) . "'");

Answer 2

If your data is sanitized, remove the single quotes from around the php variables.