mysql - PHP Variable in SQL Statement -

i receive following error when use variable in sql statement:

you have error in sql syntax; check manual corresponds mysql     server version right syntax use near '1 = 86 id = 284' @ line 1 

the code sql (which being used in php) is:

for($l=0; $l<count($item); $l++) { $query = "update  members set  item" . $l+1 . " = ".$itemid[$l]." id = ".$_session['id']; $result = $mysqli->query($query) or die($mysqli->error); } 

i know error isn't coming session variable, if coming l, don't know why. thought did correctly. why receive error , how prevent it?

your query mixing user data in without proper escaping:

for($l=0; $l<count($item); $l++) {   /* use sprintf avoid injecting arbitrary strings query */   $query = sprintf("update  members set item%d=? id=?", $l + 1);    /* prepare statement , bind specific user data values placeholders */   $stmt = $mysqli->prepare($query);   $stmt->bind_param('is', $itemid[$l], $_session['id']);    /* execute , result */   $result = $stmt->execute(); } 

the or die pattern worst possible way handle errors. you'd better off raising exceptions , catching somewhere can recover them , present user-friendly message.