mysql_query("UPDATE order_data SET qnty ='".mysql_real_escape_string($quantity)."', price = '".mysql_real_escape_string($price)."' WHERE orderid='".mysql_real_escape_string($orderid)."' and prodid='".mysql_real_escape_string($prodid)."'");