为什么这个mysql更新脚本不起作用？

Question

我一直在墙上撞了几个小时，试图让这个更新我的数据库。

<?
//edit_item_data.php
$con=mysqli_connect("localhost","root","","Inventory");
// Check connection
if (mysqli_connect_errno())
  {
  echo "Failed to connect to MySQL: " . mysqli_connect_error();
  }
  $sql= "UPDATE Item 
          SET Catagory = '$_POST[Catagory]',
          Cost = '$_POST[Cost]',
          Condition = '$_POST[Condition]',
          PurchaseLot_PurchaseLotID = '$_POST[PurchaseLot]',
          Location = '$_POST[Location]',
          Desc = '$_POST[Desc]',
          Notes = '$_POST[Notes]'
          WHERE 
          ItemID = '$_POST[id]'";

if (!mysqli_query($con,$sql))
  {
  die('Error: ' . mysqli_error($con));
  }
echo "1 record added";

mysqli_close($con);
?>
<script type='text/javascript'>
 settimeout('self.close()',5000);
</script>

这是我得到的错误

Error: You have an error in your SQL syntax; check the manual that corresponds to 
your MySQL server version for the right syntax to use near 'Condition = New,     
PurchaseLot_PurchaseLotID = 1, Location = e' at line 4

我正在运行mysql 5.6和php 5.5。我确定它有些愚蠢，但我不能为我的生活看到它是什么。

Answer 1

嗯，你很害羞地SQL injection正在做你正在做的事情，但问题是你没有把你的变量括在引号中，例如：

SET Catagory = '$_POST[Catagory]',
-- etc

在将它们放入SQL之前使用mysqli_real_escape_string to escape your variables，如下所示：

SET Catagory = '" . mysqli_real_escape_string($_POST['Catagory'], $con) . "',

Answer 2

你想要这样的东西：

$sql = "UPDATE `Item` SET
   `Catagory` = '".mysqli_real_escape_string($_POST['Catagory'],$con)."',
   `Cost` = '".mysqli_real_escape_string($_POST['Cost'],$con)."',
   ........
   WHERE `ItemID` = ".intval($_POST['id']);

旁注，它拼写为“类别”。

---

编辑：如果你像我一样，不能被诅咒输入这么长的函数名......

$e = function($str) use ($con) {
    return mysqli_real_escape_string($str,$con);
};

然后：

... `Catagory` = '".$e($_POST['Catagory'])."' ...

Answer 3

真正的问题是缺乏严肃的口音

        SET `Catagory` = '$_POST[Catagory]',