通过 PHP 更新 MySQL 不起作用

Question

我有这段代码在我的网页上运行 PHP。我一定有一点小错误，因为当我点击此页面上表单上的提交按钮时，它什么也没做！它已经让我发疯了好几个小时。

这是表格：

<form method="POST">
<strong><br>
</strong><p><input name="creaturein" type="hidden" value="Goblar"><br>
</p><table style="border: 1px;">
                <tbody><tr>
<td></td>
<td>Creature</td>
<td>Stage</td>
<td>Gender</td>
<td>Frozen</td>
</tr>
<tr>
<td rowspan="2"><img src="http://static.eggcave.com/90by90/goblar_2.png"></td>
<td>Goblar</td>
<td><select name="stagein"><option selected="" disabled="">Unspecified</option><option value="Unspecified">Unspecified</option><option value="Stage1">Stage 1(Egg)</option><option value="Stage2">Stage 2</option><option value="Stage3">Stage 3</option><option value="Stage4">Stage 4</option></select></td>
<td><select name="genderin"><option selected="" disabled="">Unspecified</option><option value="Unspecified" selected="">Unspecified</option><option value="Female">Female</option><option value="Male">Male</option></select></td>
<td><select name="frozenin"><option selected="" disabled="">Unspecified</option><option value="Unspecified">Unspecified</option><option value="Yes">Yes</option><option value="No">No</option></select></td>
</tr><tr>
<td colspan="2">Notes: <input name="notesin" type="text" value=""></td>
<td><input name="update" type="submit" id="update" value="Update"></td>
<td><input name="delete" type="submit" id="delete" value="Delete"></td>
</tr>
</tbody></table>
</form>

这是应该更新表格的代码：

 // Info to connect to the Wishlist database
        $servername = "****";
        $dbusername = "****";
        $password = "****";
        $dbname1 = "****";
        $dbname2 = "****";

        // To connect to the database please
        $conn = mysqli_connect($servername, $dbusername, $password, $dbname1);

        // If unable to connect to the database display this error
        if ($conn->connect_error) {
            echo "Connection to wishlist failed";
            die("Connection failed: " . $conn->connect_error);
        }

        // Get current user's username
        $current_user = wp_get_current_user();
        $username = $current_user->user_login;

if(isset($_POST['update'])){
    $stage = $_POST['stagein'];
    $gender = $_POST['genderin'];
    $frozen = $_POST['frozenin'];
    $notes = $_POST['notesin'];
    $creature = $_POST['creaturein'];

    $sql2 = 'UPDATE $username SET Stage = "$stage" AND Gender = "$gender" AND Frozen= "$frozen"' .
        ' AND Notes = "$notes" WHERE Creature = "$creature"';
    if ($conn->query($sql2) === TRUE) {
        echo "Record updated successfully";
    } else {
        echo "Error updating record: " . $conn->error;
    }

    // To connect to the database please
    $conn2 = new mysqli($servername, $dbusername, $password, $dbname2);

    // If unable to connect to the database display this error
    if ($conn2->connect_error) {
        echo "Connection to Creatures failed";
        die("Connection failed: " . $conn2->connect_error);
    }

    $sql3 = "SELECT Stage$stage FROM Creatures WHERE Name = '$creature'";
    if ($conn2->query($sql3) === TRUE) {
        echo "Record updated successfully";
    } else {
        echo "Error updating record: " . $conn2->error;
    }

    $sql4 = "UPDATE $username SET Picture='$retval' WHERE Creature = '$creature'";
    if ($conn->query($sql4) === TRUE) {
        echo "Record updated successfully";
    } else {
        echo "Error updating record: " . $conn->error;
    }

    $conn2->close();
}

而且删除按钮也不起作用。

if(isset($_POST['delete'])){
    $stage = $_POST['stagein'];
    $gender = $_POST['genderin'];
    $frozen = $_POST['frozenin'];
    $notes = $_POST['notesin'];
    $creature = $_POST['creaturein'];

    $sql5 = "DELETE FROM $username WHERE Creature = '$creature' AND Stage = '$stage' AND " .
        "Gender = '$gender' AND Frozen = '$frozen' AND Notes = '$notes'";
    if ($conn->query($sql5) === TRUE) {
        echo "Record updated successfully";
    } else {
        echo "Error updating record: " . $conn->error;
    }
}

// Close the connection to the database
$conn->close();

我没有收到任何错误消息。我只是迷路了。求救！

----------------------------------------------- ----------------------------------------

----------------------------------------------- ----------------------------------------

---

我有这个！这在大多数情况下都有效

if(isset($_POST['update'])){
    // prepare and bind
    $stmt = $conn->prepare("UPDATE " . $username. " SET Stage = ?, Gender = ?, Frozen = ?, Notes = ? WHERE Creature = ?");
    $stmt->bind_param('sssss', $stagebind, $genderbind, $frozenbind, $notesbind, $creaturebind);

    // set parameters and execute
    $stagebind = $_POST['stagein'];
    $genderbind = $_POST['genderin'];
    $frozenbind = $_POST['frozenin'];
    $notesbind = $_POST['notesin'];
    $creaturebind = $_POST['creaturein'];
    $stmt->execute();

    $stmt->close();
    exit();
    // To connect to the database please
    $conn2 = mysqli_connect($servername, $dbusername, $password, $dbname2);

    // If unable to connect to the database display this error
    if ($conn2->connect_error) {
        echo "Connection to Creatures failed";
        die("Connection failed: " . $conn2->connect_error);
    }

    // prepare and bind
    $stmt2 = $conn2->prepare("SELECT ? FROM Creatures WHERE Name = ?");
    $stmt2->bind_param('ss', $stagebind, $creaturebind);

    // set parameters and execute
    $creaturebind = $_POST['creaturein'];

    $stmt2->bind_result($picture);
    $stmt2->fetch();

直到这里。它没有将 $picture 信息保存在我的愿望清单数据库中。

    // prepare and bind
    $stmt3 = $conn->prepare("UPDATE " . $username . " SET Picture = ? WHERE Creature = ?");
    $stmt3->bind_param('ss', $picture, $creaturebind);

    // set parameters and execute
    $creaturebind = $_POST['creaturein'];

    $stmt3->execute();
    $stmt3->close();
    $stmt2->close();
    $conn2->close();
}

Answer 1

忘记添加<form method="POST">。默认情况下，不添加方法时，html考虑form method='GET'。

更新：您忘记添加用于通知字段类型的第一个参数。见下文：

$stmt->bind_param('sssss',$stagebind, $genderbind, $frozenbind, $notesbind, $creaturebind);

更新 2：删除 exit()。另一项调整，检索列的问号将不起作用，仅在 where 条件下使用问号。见下文：

// prepare and bind
    $stmt2 = $conn2->prepare("SELECT $stagebind FROM Creatures WHERE Name = ?");
    $stmt2->bind_param('s',$creaturebind);

Answer 2

请注意您的 HTML 表单代码未说明表单操作或方法。

试试这个：

<form action ="" method="POST">

如果您不提及此方法，则假定该方法为 GET，因此您的 isset($_POST[...]) 代码不会被执行。

Answer 3

为什么没有人认为这些变量被直接用于查询？严重的是，请使用prepared statements，否则极有可能发生SQL注入。