使用 php 和 mySQL 更新帐户详细信息

Question

我正在尝试创建一个表单来更新存储在数据库中的用户详细信息，但我收到了错误 Parse error: syntax error, unexpected '"' in update.php on line 18。我想说用与会话匹配的用户名更新用户（会话存储用户名）我不知道为什么它错了，因为我之前使用过与会话用户名的比较并且它工作正常。我还必须使用新用户名更新会话吗？？

更新.php

<?php

session_start();

function updateAccount(){
    $pdo=new PDO('mysql:host=localhost;dbname', 'name', 'password');

    $name=$_POST['Name'];
    $surname=$_POST['Surname'];
    $email=$_POST['Email'];
    $username=$_POST['Username'];
    $password=$_POST['Password'];

//Execute the query

$hashPass = hash('sha512', $password);

$st = $pdo->prepare('UPDATE Users SET Name = :Name, Surname = :Surname, Email = :Email, Username = :Username, Password = :Password WHERE Username = '".$_SESSION['userName']."'');

    if(!isset($error)){
        //no error
        $st->execute(array('Name' => $name, 'Surname'=>$surname, 'Email'=>$email, 'Username'=> $username, 'Password' => $hashPass));



        header("Location: user.php");

    }else {
        echo "Error";
    }

}
}

if(isset($_POST['update'])){
    newAccount();
}

?>

用户输入详细信息的表单（不确定这会有所不同）

<form id="update" method="post"  action="update.php">
            <h2>Account Update:</h2>
                <br>Name:
            <input type="text" name="Name" placeholder="Name">
                <br>Surname:
            <input type="text" name="Surname" placeholder="Surname">
                <br>Email:
            <input type="email" name="Email" placeholder="Email">
                <br>Username:
            <input type="text" name="Username" placeholder="Username">
                <br>Password:
            <input type="password" name="Password" placeholder="Password">
                <br>Re-enter Password:
            <input id="pass2" type="password" name="Password_check" placeholder="Password Check">
            <br><input id="updates" type="submit" name="update" value="Update"> <br>
            </form> 

Answer 1

这样写

 $st = $pdo->prepare("UPDATE Users SET Name = :Name, Surname = :Surname, Email = :Email, Username = :Username, Password = :Password WHERE Username = '{$_SESSION['userName']}'");

Answer 2

尝试改变这一点：

$st = $pdo->prepare('UPDATE Users SET Name = :Name, Surname = :Surname, Email = :Email, Username = :Username, Password = :Password WHERE Username = '".$_SESSION['userName']."'');

用这个：

$st = $pdo->prepare("UPDATE Users SET Name = :Name, Surname = :Surname, Email = :Email, Username = :Username, Password = :Password WHERE Username = ".$_SESSION['userName']);

Answer 3

这是更新 PHP 的第 18 行：

st = $pdo->prepare('UPDATE Users SET Name = :Name, Surname = :Surname, Email = :Email, Username = :Username, Password = :Password WHERE Username = '".$_SESSION['userName']."'');

这里的单引号 Username = ' 关闭字符串：UPDATE Users SET Name = :Name, Surname = :Surname, Email = :Email, Username = :Username, Password = :Password WHERE Username = 然后紧跟在此处的双引号：".$_SESSION..." 因此，在不使用 concat 运算符的情况下创建另一个字符串，因为点在新字符串内， php 将其视为字符串的一部分（简单字符），而不是字符串运算符。点运算符必须在这些字符串之间。 Username = '."$_SESSION。同样的问题在这里出现：$_SESSION['userName']."''); 它应该是$_SESSION['userName']".'')。请注意，虽然在字符串的 at 处连接 '' 是合法的，但它没有任何意义。

你可以简单地用这个代替。

st = $pdo->prepare('UPDATE Users SET Name = :Name, Surname = :Surname, Email = :Email, Username = :Username, Password = :Password WHERE Username = '.$_SESSION['userName']);

或者，因为 PHP 的双引号字符串解析变量。

st = $pdo->prepare("UPDATE Users SET Name = :Name, Surname = :Surname, Email = :Email, Username = :Username, Password = :Password WHERE Username = $_SESSION['userName'].");

你的选择。