【发布时间】:2018-03-24 16:18:38
【问题描述】:
一直在不知疲倦地尝试。搜索了几十个威胁,没有运气。我的代码似乎有错误,我似乎找到了。
我正在尝试使用 sql 更新我的数据库中的记录。当我点击提交时,页面重定向到我设置的页面,以显示我正在尝试更新的表的内容,但没有任何变化。
<?php
/* Database credentials. Assuming you are running MySQL
server with default setting (user 'root' with no password) */
define('DB_SERVER', '###');
define('DB_USERNAME', '###');
define('DB_PASSWORD', '###');
define('DB_NAME', '###');
/* Attempt to connect to MySQL database */
$mysqli = new mysqli(DB_SERVER, DB_USERNAME, DB_PASSWORD, DB_NAME);
// Check connection
if($mysqli === false){
die("ERROR: Could not connect. " . $mysqli->connect_error);
}
$result = mysqli_query($mysqli,"SELECT * FROM appeals");
echo "<article>";
echo "<table class='w3-table-all w3-card-4' width='700' height='300' align='center' border='1'>
<caption><h3>Appeals</h3></caption>
<tr>
<th>Appeal ID</th>
<th>Crime ID</th>
<th>Filing Date</th>
<th>Hearing Date</th>
<th>Status</th>
<th>Update Record</th>
</tr>";
while($row = mysqli_fetch_array($result))
{
echo "<tr>";
echo "<td>" . $row['appeal_ID'] . "</td>";
echo "<td>" . $row['crime_ID'] . "</td>";
echo "<td>" . $row['filing_date'] . "</td>";
echo "<td>" . $row['hearing_date'] . "</td>";
echo "<td>" . $row['status'] . "</td>";
echo "<td style='text-align:center;'><a href='update-appeals.php?id=". $row['appeal_ID'] . "'>UPDATE</a></td>";
echo "</tr>";
}
echo "</table>";
echo "</article>";
echo "<footer>
<p>Created by: Micah George </p>
</footer>";
echo "</body></html>";
mysqli_close($mysqli);
?>
为了缩短帖子的目的,剪掉一些不需要的代码,但上面将要更新的记录的 id/主键发送到下面进行更新的页面。 (我知道它可以工作,因为我得到了 id,但我将它包括在内,以备不时之需。)
<?php
/* Database credentials. Assuming you are running MySQL
server with default setting (user 'root' with no password) */
define('DB_SERVER', '###');
define('DB_USERNAME', '###');
define('DB_PASSWORD', '###');
define('DB_NAME', '###');
/* Attempt to connect to MySQL database */
$mysqli = new mysqli(DB_SERVER, DB_USERNAME, DB_PASSWORD, DB_NAME);
// Check connection
if($mysqli === false){
die("ERROR: Could not connect. " . $mysqli->connect_error);
$id= $_GET ['id'];
if(isset($_POST['save']))
{
$sql = "UPDATE appeals SET crime_ID = '".$_POST["crime_ID"]."', filing_date = '".$_POST["filing_date"]."', hearing_date = '".$_POST["hearing_date"]."', status = '".$_POST["status"]."' WHERE appeal_ID = '$id'" ;
$result = mysqli_query($mysqli,$sql);
header('Location: jailAW-read_appeals.php');
}
echo "<article>";
echo "
<div class='form'>
<form action='update-appeals.php' method='post'>
<label id='first'> Appeal ID: $id </label><br/>
<input type='hidden' name='appeal_ID'><br/>
<label id='first'>Crime ID:</label><br/>
<select name='crime_ID'>";
$result = mysqli_query($mysqli, "SELECT crime_ID, criminal_ID FROM crimes");
while ($row = $result->fetch_assoc()) {
$id1 = $row['crime_ID'];
$criminal = $row['criminal_ID'];
echo '<option value="'.$id1.'">'.$id1.' - ('.$criminal.')</option>';
}
echo"
</select><br/>
<label id='first'>Filing Date</label><br/>
<input type='date' name='filing_date'><br/>
<label id='first'>Hearing Date</label><br/>
<input type='date' name='hearing_date'><br/>
<label id='first'>Status:</label><br/>
<select name='status'>
<option value='P'>P</option>
</select><br/><br/>
<button type='submit' name='save' style='width:205px; background-color: green;'>Submit</button>
</div>
</form>";
echo "</article>";
echo "<footer>
<p>Created by: Micah George </p>
</footer>";
echo "</body></html>";
mysqli_close($mysqli);
?>
对此很陌生,所以我的错误可能很简单,但感谢您提供任何帮助。 (用于最终项目)。
【问题讨论】:
-
您的代码容易受到 SQL 注入的攻击。使用准备好的查询代替插入。