You are building a temporary std::string object and ask it for its starting address (that's what c_str() does). As the string is temporary it will go out of scope as soon as control moves to the next statement. So, by the time mysql_query is executed, the string contents is already undefined.
Instead, assign the concattenation to a std::string object:
std::string updateCommand = ....
mysql_query (conn, updateCommand.c_str());