Concatenate fields when UPDATING mysql with php

Question

I have managed to concatenate 2 form inputs (firstName +
lastName = fullName) when Inserting a record by altering the
Dreamweaver code thus:
$insertSQL = sprintf("INSERT INTO personnel (id, firstName,
lastName, fullName) VALUES (%s, %s, %s, ('$_POST[firstName]
$_POST[lastName]'))".......
Not sure how correct this is but it works.
So I tried doing the same thing with an UPDATE page and it
doesn't work
$updateSQL = sprintf("UPDATE personnel SET firstName=%s,
lastName=%s, fullName=('$_POST[firstName]
$_POST[lastName]'))".......,
Does anyone have a clue why this will not work or a better
way of Concatenating these form fields.
thanks

Answer 1

.oO(MickWarnes)
>I have managed to concatenate 2 form inputs (firstName +
lastName = fullName)
>when Inserting a record by altering the Dreamweaver code
thus:
>
> $insertSQL = sprintf("INSERT INTO personnel (id,
firstName, lastName,
>fullName) VALUES (%s, %s, %s, ('$_POST[firstName]
$_POST[lastName]'))".......
Why do you store redundant data? If you already have the
firstName and
lastName, there's no real need to also store the
concatenation of both.
If you need the fullName in your application like I do for
example, then
"create" it on the fly when you query the DB:
SELECT
firstName,
lastName,
CONCAT_WS(' ', firstName, lastName) AS fullName
FROM
With the same method I even include an optional birth name if
available:
SELECT
IF(birthname IS NULL OR birthname = '',
lastname,
CONCAT(lastname, ' (', birthname, ')')
) AS fullLastname,
Another thing: Never(!) use $_GET or $_POST data directly in
a DB query
without validation and escaping. Read about SQL injection and
how to
prevent it, for example with calling
mysql_real_escape_string() before
the data goes into the DB. DW inserts its own function to
solve this,
but your addition in the code above doesn't make use of it,
hence your
code is vulnerable.
Micha