感谢您的收听，让我向您解释如何在付款过程中特别升级准备声明。
我没有你所有的数据，所以我会用你显示的问题来做。
这是一个简单的prepare语句，希望对你有所帮助。
$conn 是数据库连接字段，将其更改为您的
if (isset($_POST['action']) && $_POST['action']=='IPN_Handler') {
// we get all params from html form I use post method always if dont need to get a url paratemer
$amt = htmlspecialchars($_POST['amt']);
$txn_id = htmlspecialchars($_POST['tx']);
$st = htmlspecialchars($_POST['st']);
$msg = htmlspecialchars($_POST['item_name']);
$date= date("Y-m-d");
//Here we need to validate form inputs
if(empty($amt) || empty($txn_id) || empty($st) || empty($msg)) {
echo "Field all required";
}else{
$stmt = $conn->prepare("INSERT INTO Your_table_name (amt, tx, st, item_name, date) VALUES (?, ?, ?, ?, ?)");
$stmt->bind_param("sssss", $amt, $txn_id, $st, $msg, $date);
// we used bind_param so now we need to execute
if($stmt->execute()){
echo "New records created successfully";
header('Location: yourpage.php');
exit();
}else{
echo "Failed to insert new records in database.";
}
// Free yourconnection
$stmt->free_result();
}
}
更新：
在这里测试我的案例是html表单：
<form action="page.php" method="POST">
<input type="text" name="amt" placeholder="dsdsd">
<input type="text" name="tx" placeholder="sdsd">
<input type="text" name="st" placeholder="dsdsd">
<input type="text" name="item_name" placeholder="sdsd">
<input type="text" name="date" placeholder="dsdsd">
<input type="hidden" name="action" value="IPN_Handler" />
<input type="submit" name="LoginBtn" placeholder="signup">
</form>
更多解释请看这里https://www.w3schools.com/php/php_mysql_prepared_statements.asp
这里是我修改你的代码的地方：
if (isset($_GET['action']) AND $_GET['action']=='IPN_Handler') {
//Here we need to validate form inputs
$amt = mysqli_real_escape_string($link, $_GET['amt']);
$txn_id = mysqli_real_escape_string($link, $_GET['tx']);
$st = mysqli_real_escape_string($link, $_GET['st']);
$msg = mysqli_real_escape_string($link, $_GET['item_name']);
$date= date("Y-m-d");
$sql = "UPDATE wp_ready2_play SET amount=?, payment_id=?, payment_status=?, message=?, payment_dte=? WHERE id =?";
$stmt = mysqli_stmt_init($link);
if (!mysqli_stmt_prepare($stmt, $sql)) {
echo "SQL error";
} else {
mysqli_stmt_bind_param($stmt, "ssssss", $amt, $txn_id, $st, $msg, $date, $data);
mysqli_stmt_execute($stmt);
echo "Thank you for your payment";
echo "Transaction has been made successfully.";
}
// Free yourconnection
mysqli_free_result($stmt);
}