Question

所以我决定开始使用原型，这是我的第一个问题。我正在尝试向一个更新单个记录的php页面发送一个ajax请求。当我手动执行此操作时（即：键入地址+参数，它工作正常，但当我使用来自javascript的此代码时：

var pars = 'trackname=' + track + '&tracktime=' + time;

new Ajax.Request('php/setSongTime.php', {
method: 'get',
parameters: pars,
onSuccess: function(transport){
  var response = transport.responseText || "no response text";
  alert("Success! \n\n" + response);
  },
onFailure: function(){ alert('Something went wrong...') }

onSuccess触发并显示来自php的正确信息，但未进行更新。 php返回的是UPDATE字符串，所以我正在检查参数，它们看起来很好。有没有人看到问题？感谢...

总javascript：

/*This file handles all the user-based computations*/

//variable declarations to be used throughout the session
var untimedSongArray = [];

function beginProcess(){

new Ajax.Request('php/getUntimed.php', {
method: 'get',
onSuccess: function(transport){
  var response = transport.responseText || "no response text";
  untimedSongArray = response.split("+");  
  alert(response);
  getFlashMovie("trackTimer").timeThisTrack(untimedSongArray[0]); 
  //alert("Success! \n\n" + response);
  //var html = response;
  },
onFailure: function(){ alert('Something went wrong...') }

});
}

function getFlashMovie(movieName) {
  var isIE = navigator.appName.indexOf("Microsoft") != -1;
  return (isIE) ? window[movieName] : document[movieName];  }

function setSongTime(track, time){
  alert("track " + track + " has a time of " + time);
  //$.get("php/setSongTime.php", { trackname: track, tracktime: time } );
  var pars = 'trackname=' + track + '&tracktime=' + time;

  new Ajax.Request('php/setSongTime.php', {
  method: 'get',
  parameters: pars,
  onSuccess: function(transport){
    var response = transport.responseText || "no response text";
    alert("Success! \n\n" + response);
    },
  onFailure: function(){ alert('Something went wrong...') }
  });
}

总PHP代码：

<?php

//turn on error reporting
ini_set('display_errors', 'On');
error_reporting(E_ALL | E_STRICT);
//header('Content-Type: text/xml');

/////////////Main script
//pull variables
//need to do some error checking here
$trackname = ($_GET['trackname']);
$tracktime = ($_GET['tracktime']);

//remove leading track information
$trackname = str_replace('../music_directory/moe/moe2009-07-18/', '', $trackname);
$trackname = str_replace('.mp3', '', $trackname);
//echo $trackname;

//connect with database
$con = mysql_connect("localhost","root","");
if(!$con){
  die('Could not connect: ' . mysql_error());
}

mysql_select_db("musicneverstopped", $con);
//end connecting to database

//////////////////////////////////////////

//update given song time
$sql = "UPDATE songs SET length = ".$tracktime." WHERE unique_song_id = ".$trackname;
echo $sql;
mysql_query("UPDATE songs SET length = '$tracktime' WHERE unique_song_id = '$trackname'");

//error check
//if(!$attempt){
//die(mysql_error());
//}

//////////////////////////////////////////

//close database connection
mysql_close($con);//close mysql connection


?>

任何人都会看到任何失败的错误？

Answer 1

尝试回显您在mysql_query中实际运行的完全相同的SQL（将其存储在$sql中，然后将其传递给查询，而不是将查询写出两次）。

然后尝试运行在服务器上的mysql命令行中直接在响应中回显的查询，看看会发生什么。

另外，为了回应Max关于转义SQL查询的重要性，我会在输入中添加你应该在查询中使用绑定变量，而不是仅仅将用户输入与SQL的其余部分连接起来。 / p>
这样的事情可以确保您的变量被适当地转义以避免SQL注入攻击。

$sql = "UPDATE songs SET length = '%s' WHERE unique_song_id = '%s'"; $query = sprintf( $sql, mysql_real_escape_string($tracktime), mysql_real_escape_string($trackname) ); mysql_query($query);

Answer 2

发现它！不知何故，我在最终的$ trackname之前获得了额外的空间。 ltrim把它修好了。感谢大家，感谢那些提到安全功能的人。我肯定会实现这些。丹

原型ajax没有正确执行查询

2 个答案: