SELECT and UPDATE not working -- MySQL

Question

Hello,

After I upload a photo to a server, I want to save it in the user's database in MySQL, but for some reason, it is not working. Below is the code for uploader.php:

session_start();
if(!$_SESSION['userid']) {
  header("Location: index.php"); 
  exit;
}


$con = mysql_connect("host","db","pw");
if (!$con)
  {
  die('Could not connect: ' .mysql_error());
  }

mysql_select_db("db", $con);

$sess_userid = mysql_real_escape_string($_SESSION['userid']);
$query  = "SELECT * FROM Members  WHERE fldID='$sess_userid' UPDATE Members SET PortraitPath = 'profileportraits/' . '$_FILES[file][name]'");  
$result = mysql_query($query) or trigger_error(mysql_error().$query);
$row = mysql_fetch_assoc($result);

I'm sure there is something very wrong with my query, but I can't figure out what it is. The photo is definitely being saved into the folder. But I simply want to update its path in the user database for later use. Thank you!

Answer 1

You can do two separate queries:

UPDATE Members SET PortraitPath = 'profileportraits/' . '$_FILES[file][name]'
 WHERE fldID='$sess_userid';

And:

SELECT * FROM Members  WHERE fldID='$sess_userid'

Answer 2

It seems you tried to put two queries(SELECT and UPDATE) into one query which will result in invalid query error.

Just wondering why you need two queries since you already know the userid and all you want is to update. All you need is to update the file path

UPDATE Members SET PortraitPath = 'profileportraits/' . '$_FILES[file][name]' WHERE fldID='$sess_userid';

Answer 3

as it was mentioned already, you cannot use these two queries at once.
but there is also weird syntax: you're trying to use PHP's concatenation operator inside of mysql query.
And you did not escape a string parameter - very bad!
So, looks like you need something like

$sess_userid = mysql_real_escape_string($_SESSION['userid']);
$PortraitPath = mysql_real_escape_string('profileportraits/' . $_FILES['file']['name']);
$query  = "UPDATE Members SET PortraitPath = '$PortraitPath' WHERE fldID='$sess_userid'";