title: Multiple parameters in SQL query in PHP
body: <p>I'm trying to use the following code to edit a row in a database using a userid parameter.</p>
  
  <p>But with the code I get this error:</p>
  
  <blockquote>
    <p>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'SET firstname = IF(? &lt;> '', ?, firstname), SET surname = IF(? &lt;' at line 3</p>
  </blockquote>
  
  <p>I'm really not sure what's the problem as everything looks in order in the SQL query. I've tried taking out the IF(? &lt;> '', ?, ) but it still gives the error. I've double checked that all the column names in the table are correct. What am I doing wrong? </p>
  
  <pre><code>&lt;?php
  
  
          include 'database_conn.php';
  
          if(!$conn)
          {
              echo "Error connecting to database";
          }
  
          if (mysqli_connect_errno()) 
          {
              echo "&lt;p&gt;Connection failed:".mysqli_connect_error()."&lt;/p&gt;\n";
          }
  
  
          $id = isset($_GET['userId']) ? $_GET['userId'] : NULL; 
  
          $newUsername = isset($_REQUEST['updateUsername']) ? $_REQUEST['updateUsername'] : NULL;
          $newEmail = isset($_REQUEST['updateEmail']) ? $_REQUEST['updateEmail'] : NULL;
          $newPassword = isset($_REQUEST['updatePassword']) ? $_REQUEST['updatePassword'] : NULL;
          $newForename = isset($_REQUEST['updateForename']) ? $_REQUEST['updateForename'] : NULL;
          $newSurname = isset($_REQUEST['updateSurname']) ? $_REQUEST['updateSurname'] : NULL;
          $newDob = isset($_REQUEST['updateDob']) ? $_REQUEST['updateDob'] : NULL;
  
  
          $sql = "UPDATE Users
                  SET username = IF(? &lt;&gt; '', ?, username),
                  SET firstname = IF(? &lt;&gt; '', ?, firstname),
                  SET surname = IF(? &lt;&gt; '', ?, surname),
                  SET email = IF(? &lt;&gt; '', ?, email),
                  SET password = IF(? &lt;&gt; '', ?, password),
                  SET dateofbirth = IF(? &lt;&gt; '', ?, dateofbirth)
                  WHERE id = ?";
  
  
          $stmt = mysqli_prepare($conn, $sql)
              or die(mysqli_error($conn));  
  
          mysqli_stmt_bind_param($stmt, "ssssssi", $newUsername, $newForename, $newSurname, $newEmail,
                              $newPassword, $newDob, $id)
              or die(mysqli_error($conn));  
  
          mysqli_stmt_execute($stmt)
              or die(mysqli_error($conn));  
  
  
  
  
          if($stmt)
          {
              echo "Details updated successfully";   
          }
          else
          {
              die(mysqli_error($conn));  
          }
  
          mysqli_close($conn);
  
          ?&gt;
  </code></pre>