From the error message, I suspect you have the key with date type a string. You should escape all values befor put it into the query.
I suggest you to try AdoDB library. This library is multi-database and will help you to easily do insert and update. Example of update using AdoDB:
$regno = $adodb->qstr('TAC 2123');
$data = array(
'col1' => 'val1',
'col2' => 'val2',
'col3' => 'val3'
);
$result = $adodb->AutoExecute($tablename, $data, 'UPDATE', "regno=$regno");
By escaping the value before put it into a query, you can prevent the SQL injection attact. Doing it using AdoDB Autoexecute, then the escape of values is doing automatically by AdoDB.
For the key with type string, you must do it manually. If the key is an integer, using intval
is preferable than $adodb->qstr()
.