【问题标题】:Update SQL data within PHP在 PHP 中更新 SQL 数据
【发布时间】:2015-04-02 15:58:37
【问题描述】:

好的,我已经更新了我的代码,没有收到任何错误,但 mysql 端和 PHP 前端都没有更新。

我什至尝试过硬编码语句。

此部分位于我的 Php 查看器页面的最顶部..

<?php
/

    / IF RESQUEST IS EQUAL TO SUBMUIT
    if (isset($_REQUEST['submit']))
            {   
                $my_date = date("Y-m-d H:i:s");
                $order = uniqid();
                $FullName= $_REQUEST['fullname'];
                //Take in full Name and Split it into first and last name.
                list($fname, $lname ) = explode( ' ', $customerName, 2 );       
                $address = $_REQUEST['address'];
                $emailAddress = $_REQUEST['emailAddress'];
                $phoneNo = $_REQUEST['phoneNo'];


Below is my Sticky Forum which is getting the Information from the Database and putting it into the Text Fields 

    // STICKY FORM TO ALLOW USER TO UPDATE INFORMATION 
    if (isset($_REQUEST['up']))
        {
            $query_sticky = mysqli_query($connection,'SELECT * FROM orders WHERE id = "' . $_GET['id'] . '"');
            if(! $query_sticky )
    {
      die('Could not get data: ' . mysqli_error($connection)); // Could not find Order_id show Error
    }//end die error 
    else
        (isset($_REQUEST['update']));
        {
    while($row = mysqli_fetch_array($query_sticky, MYSQLI_ASSOC))
    {
        $row['id'];
        echo '<form action="" method="post">'

      Name:';
            echo'<input name="customerName" id="cname" type="text" required   value="'.$row['firstname']. " " .$row['lastname']. '" />';
           echo' <br/>
            <br/>
            Address:
           <textarea name="address" id = "caddress" type="text" rows="5" cols="30" required value="'.$row['address'].'" ></textarea>
            <br/>
            <br/>
            Email Address:
           <input name="emailAddress" type="email" required  value="'.$row['email']. '" />
            <br/>
            <br/>
            <br/>
            Phone Number:
             <input name="phoneNo" id="phoneNumber" type="text" required  value="'.$row['phone']. '" />
            <br/>
             <br/>
          <button type="submit" name="update" value="update" >update</button
      <div id="Submit">
        </form>
        <form action="order.php" method="delete">
        </form>';
    }//close if 
        }
    } // Close While 

here is my Update Section 

    if (isset($_REQUEST['update']))
    {
            $updateDB = "UPDATE orders SET student ='$_POST[student]', 
            firstname='John', lastname='wallace',
            email = '$_POST[emailAddress]', address = '$_POST[address]',
            phone = '$_POST[phoneNo]'
            WHERE 
            order_id ='$_GET[order_id]'";
            mysqli_query($connection, $updateDB);
        }//end update..     
        }//end PHP 
    ?>

【问题讨论】:

  • 您的代码对SQL injection 漏洞利用开放。使用prepared statements
  • 您不能将mysql_error()mysqli_query 一起使用。这就是为什么您收到“无法更新数据:”但没有看到错误的原因。
  • 不应该是$_POST['update']而不是$_REQUEST['update']吗?
  • $_REQUEST 包含来自$_GET$_POST 的所有内容。
  • 另外,你可能不想使用@$stackoverflow.com/questions/3551527/…

标签: php


【解决方案1】:

您在UPDATE 查询字符串中混淆了单引号和双引号。试试这个:

$updateDB = "UPDATE test
SET email = '".@$_POST[$emailAddress]."',
address = '".@$_POST[$address]."',
phone = '".@$_POST[$phoneNo]."'
WHERE id = '".$_GET['id']."'";

【讨论】:

  • 混合 API 并抑制错误。除此之外都很好¯\_(ツ)_/¯
  • 第一次这样的评论让我哈哈大笑......但是这个 PHP 很粗俗,我不需要吃一整块黄油就知道它是腐烂的。
猜你喜欢
  • 1970-01-01
  • 1970-01-01
  • 1970-01-01
  • 2020-12-06
  • 2016-04-16
  • 1970-01-01
  • 1970-01-01
  • 2016-02-13
  • 2017-08-25
相关资源
最近更新 更多