MYSQL Update Query syntax issues

I am currently attempting to update a specific record in my database however although I have checked the syntax thoroughly chrome is telling me that I have it wrong somewhere.

Any advise would be greatly appreciated

$title = $_POST["title"];
$alttext = $_POST["alttext"];
$description = $_POST["description"];
$price = $_POST["price"];
$id = $_POST["ID"];
$insertQuery = "UPDATE cmsproducts SET Title = '$title', Alt_Text = '$alttext', Source = '$target_path', Description = '$description', Price = $price WHERE ID = $id";

// Save the form data into the database 
if ($result = $connector->qu开发者_如何转开发ery($insertQuery)){

// It worked, give confirmation
echo '<center><b><span style="color: #FF0000;">Product added to the database</span></b></center><br /><br />';

}else{

// It hasn't worked so stop. Better error handling code would be good here!
echo('<center>Sorry, there was an error saving to the database</center>');
echo "<center><b>File Name:</b> ".$target_path."<br/>";
die(mysql_error());


}

I have tried the query without the variables to check if it was a problem there but it still screamed error at me:

Sorry, there was an error saving to the database You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'of test, Source=../images/Pictures/, Description=This is a test image of test ' at line 1

---

Always escape user input (mysql_real_escape_string) or use PDO and assign parameters. It seems that $alttext variable has quote or other special character in it. For example,

$title = mysql_real_escape_string($_POST["title"]);
$alttext = mysql_real_escape_string($_POST["alttext"]);
$description = mysql_real_escape_string($_POST["description"]);
$price = mysql_real_escape_string($_POST["price"]);
$id = mysql_real_escape_string($_POST["ID"]);
$insertQuery = "UPDATE cmsproducts SET Title = '$title', 
   Alt_Text = '$alttext', Source = '$target_path',
   Description = '$description', Price = '$price' WHERE ID = '$id'";

---

It seems you're not escaping quotes as your column Description must have a single quote inside. Use mysql_real_escape_string to escape quotes.