Question

我有一个网站www.jazz.eu. 我在另一台服务器上将此站点的精确副本复制到另一个具有不同域名的站点。新的是www.vetur.nl。

一切正常（我的意思是类似于jazz.eu）。除了购物车流程。首先，当我看到购物车时，我总是有一条空的产品线。我无法删除它。看看我的意思

http://www.vetur.nl/cart_empty_product_line.jpg

我的下一个问题是，当我尝试刷新购物车或发送订单时，我收到此消息

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near
'sender_full_name='',sender_afm='',sender_doy='',sender_work='',sender_person='',' at line 1
query=update basket set selected_quantity=,sender_full_name='' ,sender_afm='',sender_doy='',sender_work='',sender_person='',sender_address='',sender_zip='',sender_tel='',sender_fax='', addresser_email='', additional='' where session_id = 'ihcvafpk3fgqh6jra1mrplgkr1' and id=

我认为问题出在这个文件process.php中，但我找不到它。确切的文件在我的第一个网站jazz.eu中正常工作。似乎有问题的process.php的代码如下。谢谢你，原谅任何发布错误。这是我第一次在这里发帖。

    function procMy_cart(){
        global $session, $form,$database,$mailer;

        $session_id = session_id();
        if ((isset($_POST['order'])) && ($_POST['order']==1)) {
            if (!eregi("[a-z\α-ω\!\"\£\$\%\^\&\*\(\)\-\+\{\}\:\;\'\@\~\#\\\|\<\>\?\/]", $_POST['update_quantity'][$i])) {
                        For ($i=0;$i<count($_POST['update_quantity']);$i++) {

                    if (!eregi("[a-z\α-ω\!\"\£\$\%\^\&\*\(\)\-\+\{\}\:\;\'\@\~\#\\\|\<\>\?\/]", $_POST['update_quantity'][$i])) {
                        //$update_db="update basket set selected_quantity=".$_POST['update_quantity'][$i].",addresser='".$_POST['addresser']."',addresser_tel='".$_POST['addresser_tel']."', addresser_email='".$_POST['addresser_email']."', additional='".$_POST['additional']."' where session_id = '$session_id' and id=".$_POST['update_id'][$i]."";
                        $update_db="update basket set selected_quantity=".$_POST['update_quantity'][$i].",sender_full_name='".$_POST['addresser']."',sender_afm='".$_POST['addresser_afm']."',sender_doy='".$_POST['addresser_doy']."',sender_work='".$_POST['addresser_work']."',sender_person='".$_POST['addresser_contact']."',sender_address='".$_POST['addresser_address']."',sender_zip='".$_POST['addresser_zip']."',sender_tel='".$_POST['addresser_tel']."',sender_fax='".$_POST['addresser_fax']."', addresser_email='".$_POST['addresser_email']."', additional='".$_POST['additional']."' where session_id = '$session_id' and id=".$_POST['update_id'][$i]."";
                        $result=$database->query($update_db);

                    } else {

                        //$update_db="update basket set selected_quantity=1,addresser='".$_POST['addresser']."',addresser_tel='".$_POST['addresser_tel']."',addresser_email='".$_POST['addresser_email']."', additional='".$_POST['additional']."' where session_id = '$session_id' and id=".$_POST['update_id'][$i]."";
                        $update_db="update basket set selected_quantity=1,sender_full_name='".$_POST['addresser']."',sender_afm='".$_POST['addresser_afm']."',sender_doy='".$_POST['addresser_doy']."',sender_work='".$_POST['addresser_work']."',sender_person='".$_POST['addresser_contact']."',sender_address='".$_POST['addresser_address']."',sender_zip='".$_POST['addresser_zip']."',sender_tel='".$_POST['addresser_tel']."',sender_fax='".$_POST['addresser_fax']."', addresser_email='".$_POST['addresser_email']."', additional='".$_POST['additional']."' where session_id = '$session_id' and id=".$_POST['update_id'][$i]."";
                        $result=$database->query($update_db);
                    }
                }
            }
//          $retval = $session->my_cart($_POST['addresser'], $_POST['addresser_doy'], $_POST['addresser_work'], $_POST['addresser_afm'], $_POST['addresser_address'], $_POST['addresser_zip'], $_POST['addresser_contact'], $_POST['addresser_email'], $_POST['addresser_tel'], $_POST['addresser_fax'], $_POST['additional']);
//          if ($retval) {
//               $_SESSION['send_order'] = true;
//              header("Location: my_cart2.php");//.$session->referrer);
//          } else {
//              $_SESSION['value_array'] = $_POST;
//              $_SESSION['error_array'] = $form->getErrorArray();
//              header("Location: my_cart2.php");//.$session->referrer);
//          }
        header("Location: order2.php");

        } else if ((isset($_POST['order'])) && ($_POST['order']!=1)) {
            if ((isset($_POST['refresh_basket'])) && ($_POST['refresh_basket']==1)) {
                For ($i=0;$i<count($_POST['update_quantity']);$i++) {
                    //echo $_POST['update_id'][$i];
                    if (!eregi("[a-z\α-ω\!\"\£\$\%\^\&\*\(\)\-\+\{\}\:\;\'\@\~\#\\\|\<\>\?\/]", $_POST['update_quantity'][$i])) {
                        //$update_db="update basket set selected_quantity=".$_POST['update_quantity'][$i].", addresser='".$_POST['addresser']."', addresser_tel='".$_POST['addresser_tel']."',  addresser_email='".$_POST['addresser_email']."', additional='".$_POST['additional']."' where session_id = '$session_id' and id=".$_POST['update_id'][$i]."";
                        $update_db="update basket set selected_quantity=".$_POST['update_quantity'][$i].",sender_full_name='".$_POST['addresser']."',sender_afm='".$_POST['addresser_afm']."',sender_doy='".$_POST['addresser_doy']."',sender_work='".$_POST['addresser_work']."',sender_person='".$_POST['addresser_contact']."',sender_address='".$_POST['addresser_address']."',sender_zip='".$_POST['addresser_zip']."',sender_tel='".$_POST['addresser_tel']."',sender_fax='".$_POST['addresser_fax']."', addresser_email='".$_POST['addresser_email']."', additional='".$_POST['additional']."' where session_id = '$session_id' and id=".$_POST['update_id'][$i]."";
                        $result=$database->query($update_db);

                    } else {
                        //$update_db="update basket set selected_quantity=1, addresser='".$_POST['addresser']."', addresser_tel='".$_POST['addresser_tel']."',  addresser_email='".$_POST['addresser_email']."', additional='".$_POST['additional']."' where session_id = '$session_id' and id=".$_POST['update_id'][$i]."";
                        $update_db="update basket set selected_quantity=1,sender_full_name='".$_POST['addresser']."',sender_afm='".$_POST['addresser_afm']."',sender_doy='".$_POST['addresser_doy']."',sender_work='".$_POST['addresser_work']."',sender_person='".$_POST['addresser_contact']."',sender_address='".$_POST['addresser_address']."',sender_zip='".$_POST['addresser_zip']."',sender_tel='".$_POST['addresser_tel']."',sender_fax='".$_POST['addresser_fax']."', addresser_email='".$_POST['addresser_email']."', additional='".$_POST['additional']."' where session_id = '$session_id' and id=".$_POST['update_id'][$i]."";
                        $result=$database->query($update_db);
                    }
                }
            }
            $_SESSION['value_array'] = $_POST;
            $_SESSION['error_array'] = $form->getErrorArray();
            header("Location: my_cart2.php");//.$session->referrer);
        }
    } // end cart

Answer 1

变量$_POST['update_quantity'][$i]没有值。如果您查看查询，您会注意到set selected_quantity=,sender_full_name=''。您至少需要一组单引号或null分配给selected_quantity。

您永远不应将_POST数据直接分配到查询中。始终以某种方式擦除它以避免SQL注入攻击。你可能很早就将$ _POST ['update_quantity'] [$ i]分配给变量并执行一些逻辑以确保它具有有效值，如果没有，则阻止查询运行或添加默认值。

我在SQL消息中找不到解决方案。我想要一些建议

1 个答案: