mysql - Php + sql statement always returns successfull? -

this code

<?php include("global.php");  $username = mysql_real_escape_string(stripslashes($_post["strusername"])); $password = md5(mysql_real_escape_string(stripslashes($_post["strpassword"]))); $charid = mysql_real_escape_string(stripslashes($_post["charid"])); $quest = mysql_real_escape_string(stripslashes($_post["strquest"]));   $query = "select * wherei_users, wherei_characters wherei_users.username = '{$username}' , wherei_users.password = '{$password}' , wherei_characters.username =     '{$username}' , wherei_characters.id = '{$charid}'"; $result = mysql_query($query); $yesorno = (mysql_num_rows($result) == 0) ? 'no' : 'yes';    if(empty($username) || empty($password) || empty($charid) || empty($quest) || $yesorno == "no") { $status="error"; $msg="invaliddata"; $actiontype="&actiontype=savequestdata"; $out=("$actiontype&status=$status&msg=$msg"); }  if ($yesorno = "yes") { mysql_query("update wherei_characters set strquest = '{$quest}' username = '{$username}' , id = '{$charid}'") or die(mysql_error()); $actiontype="&actiontype=savequestdata"; $status="success"; $out=("$actiontype&$status"); }  echo("$out"); ?> 

however, returns staus success? when go browser , type url, returns

you have error in sql syntax; check manual corresponds mysql server version right syntax use near '' @ line 1 

and when set values wrong on purpose returns status succesfull, see if ether $username,$password,$charid,$questis empty or $yesorno no should echo &actiontype=savequestdata&status=error&msg=invaliddata. no matter set variables to, returns `actiontype=savequestdata&sucess?

this issue:

if ($yesorno = "yes") { 

spot yet? .... ?

a single = in php assignment operator, assigning variable $yesorno equal "yes", in php (not languages) run if , equate true.

you need either:
== comparison operator
or
=== identical comparison operator.

---

---

some unrelated, yet important, side notes on code:

depreciated function
mysql_ function depreciated. should consider looking into/learning/using mysqli or pdo.

more info: how can prevent sql injection in php?

validate , sanitise
see use mysql_real_escape_string on $_post variables.
make sure checking variables before pass data onto database stage.
user enter form, , using mysql_ prone injection attacks, should careful.

what best php input sanitizing functions?

md5
php.net, developers of php, state:

note: secure password hashing
not recommended use function secure passwords, due fast nature of hashing algorithm.

see here why:
http://php.net/manual/en/faq.passwords.php#faq.passwords.fasthash