[RESOLVED] Legit SQL Code?

does this sql query look like it should work?

PHP Code:

---

UPDATE `members` SET personal_question_answer='".$_POST['ps_answer']."' AND personal_question='".$_POST['personal_question']."' WHERE member_id LIKE '".$_SESSION['member_id']."' 


---

Everything is set correctly. When i go into PHPMyAdmin and do that code manualy, it still does not work. any help?

AND needs to be replaced with a comma (",")

VB Code:

UPDATE `members` SET personal_question_answer='".$_POST['ps_answer']."', personal_question='".$_POST['personal_question']."' WHERE member_id LIKE '".$_SESSION['member_id']."'

And this code is of course subject to SQL injection if magic quotes are disabled.