Click here to Skip to main content
15,885,366 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
$query2 = $dbh -> prepare("UPDATE tblpayment SET Status= 1 WHERE id='".$order['id']."'");
$query2->execute();

What I have tried:

$status="1"
$query2 = $dbh -> prepare("UPDATE tblpayment SET Status=:status WHERE id='".$order['id']."'");
$query2->execute();
Posted
Updated 18-Apr-22 3:27am
Comments
0x01AA 17-Apr-22 14:13pm    
Think about WHERE id='".$order['id']."'");
Sujan Dangol 17-Apr-22 14:14pm    
prepare("SELECT * FROM tblvehicles WHERE id='".$_REQUEST['oid']."'");
$query->execute();
if($query)
{
if($query->execute() == 1)
{
$order = $query->fetch();
$url = "https://uat.esewa.com.np/epay/transrec";
$data =[
'amt'=> $order['PricePerDay'],
'rid'=> $_REQUEST['refId'],
'pid'=> $order['id'],
'scd'=> 'epay_payment'
];

$curl = curl_init($url);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, $data);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($curl);
curl_close($curl);
$response_code = get_xml_node_value('response_code',$response );

if ( trim($response_code) == 'Success')
{
//$sql2 = "UPDATE tblpayment SET pStatus=1 WHERE id='".$order['id']."'";
$query2 = $dbh -> prepare("UPDATE tblpayment SET Status= Status + 1 WHERE id='".$order['id']."'");
$query2->execute();

echo 'alert("Thank you for purchasing with us. Your payment has been made successfully.");
window.location.href="http://localhost/onlinecab/index.php";
';
}


}
}
}


function get_xml_node_value($node, $xml) {
if ($xml == false) {
return false;
}
$found = preg_match('#<'.$node.'(?:\s+[^>]+)?>(.*?)'.
'#s', $xml, $matches);
if ($found != false) {

return $matches[1];

}

return false;
}
Sujan Dangol 17-Apr-22 14:15pm    
i have uploaded full code
0x01AA 17-Apr-22 14:31pm    
-
Sujan Dangol 17-Apr-22 14:32pm    
please give me a solution

1 solution

Assuming your id field is numeric:
SQL isn't HTML
numeric literals don't take quotes.

PS: you wouldn't have ran into this problem if you had used a parameterized query!
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

  Print Answers RSS
Top Experts
Last 24hrsThis month


CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900