Small step to prevent SQL injection in MySQL

Use mysql_real_escape_string($string_var) to be used for every string variable.

Eg: $tip_no = mysql_real_escape_string($_POST[‘tip_no’]);

Then build the update string using the result of above statement.