YA: Simple MySQL Update 20120714180226AA10QTY

<?php

include("sql.php");

// $_REQUEST, not a fan of this type of variable retrieval, could be a potential security risk
$pid = $_REQUEST["pid"];
$url = $_POST["url"];

// Prevent SQL Injection Errors
$pid = mysql_real_escape_string($pid);

$raw = "SELECT desc FROM post WHERE post_id='{$pid}' LIMIT 1";
// Switched * - desc No Need For more information returned than you need.
// Added Apostrophes around $pid; ( { } not needed, but helpful
// LIMIT 1 - Stops MySQL From looking for more matches.

$query = mysql_query($raw) or die("no go");
$row = mysql_fetch_assoc( $query );
$ndesc = mysql_real_escape_string( $row['desc'] . '<img src="' . $url . '" />' );
// Cleans it up. No need to while, if there is only one result row
// your $ndesc variable declaration had some quoting issues.
// mysql_real_escape_string() will help with injection and escaping issues.


$string_raw = "UPDATE post SET desc='{$ndesc}' WHERE post_id='{$pid}'";
// 'desc' should be desc (no apostrophes);
// $pid should be encased with apostrophes
// { } not needed but helpful for reading

$input = mysql_query($string_raw) or die("error");

?>