Inserting variables in mysql queries - database

Question

I've written a function which updates the mysql database row with some new column data.
Here is the function:
function sql($set,$data){
$sql = mysql_query("UPDATE members SET '".$set."' = '".$data."' WHERE login = '".$_SESSION['login']."'");
if($sql){
echo 'Profile updated.';
}
else{
echo 'Could not update profile. Please try again later.';
}
}
And here is a fragment from the program which is supposed to utilise the function:
$array = array("$password", "$email", "$age");
if($array[0] != 0){
sql("password",$password);
}
if($array[1] != 0){
sql("email",$email);
}
if($array[2] != 0){
sql("age",$age);
}
It doesn't write the values to the database. What's wrong? Maybe it's the quotation of the variables in the function?

Answer 1

Remove the single quote on the SET :
function sql($set,$data){
$sql = mysql_query("UPDATE members SET ".$set." = '".$data."' WHERE login = '".$_SESSION['login']."'");
if($sql){
echo 'Profile updated.';
}
else{
echo 'Could not update profile. Please try again later.';
}
}
Column names don't dont need to be quoted
Working example here -> http://www.sqlize.com/c34I44c37r

Answer 2

It is indeed the quotation. To be specific, it's the quotation for the filed name (name, email, ..)
Just ` instead of '
SET `foo` = 'bar'
PS: Please make sure that you escape the user input before writing it to db using mysql_real_escape_string($data). Otherwise one could alter your query, which is called mysql injection.