Trying to updating a column through php and mysql

[Firas Rihan]

Hello, so I'm trying to update a column (carID) in a table called users
but I'm getting the following error:
"syntax error, unexpected double-quote mark, expecting "-" or identifier or variable or number"

Can you help me figure out what's the problem in the code?

if($_SERVER["REQUEST_METHOD"] == "POST"){
  $ID=mysqli_real_escape_string($con, $_GET['ID']);
if(isset($_POST["rentit"])){
 $sql="UPDATE users SET carID = '$ID' WHERE username = $_SESSION["username"] ";
}}

Thanks A Lot!

[Niheel]

the $_SESSION["username"] variable needs quotes in the SQL statement

original

$sql="UPDATE users SET carID = '$ID' WHERE username = $_SESSION["username"] ";

fix

$sql="UPDATE users SET carID = '$ID' WHERE username = '".$_SESSION["username"]."' ";

[garyponting071]

The explanation you are providing is really great.

[bakertaylor28]

This code has two big problems-
First you should always be using prepared statements to prevent SQL injection. The second, is that it is easier to avoid using
a session variable directly in SQL- it is better to set regular var to Session Var:

<?php
session_start();
if ( !isset ($_POST['carid'] )) {
exit('please input a carid');
}
$username = $_SESSION['username'];
$carid = $_POST['carid'];

$host='database host';
$user ='database user';
$pass = 'database pass';
$dbname = 'database name';

$con = mysqli_connect($host, $user, $pass, $dbname);
$stmt = $con->prepare('UPDATE users SET carid= ? WHERE username= ?');
$stmt->bind_param('ss', $carid, $username);
$stmt->execute(); 
$stmt->close();
$con->close();
?>

This is unnecessary:

if($_SERVER["REQUEST_METHOD"] == "POST") {

}

because form data will ALWAYS use post if we use this in html (And therefore we don't need to check for POST method) :

<form action="/foo.php"  method="post">