Question

我有两个表user和news_table。我想禁止使用类型1的用户编辑和删除类型为9的用户发布的新闻。现在，因为它代表我的代码用户类型1能够编辑和删除用户类型9发布的新闻。我需要一个新的查询到解决它。

user:
id int primary key auto_increment,
username varchar(255),
password varchar(255),
type int

news_table:
id int primary key auto_incremnet,
title varchar(255),
news text,
author varchar(50),
time date,
authorid int,
image varchar(255) NULL


if(isset($_POST['editsubmit'])){
$oldtitle=htmlentities($_POST['oldtitle']);
$newtitle=htmlentities($_POST['newtitle']);
$newtext=htmlentities($_POST['newtext']);
$oldtitle=mysqli_real_escape_string($conn,$oldtitle);
$newtitle=mysqli_real_escape_string($conn,$newtitle);
$newtext=mysqli_real_escape_string($conn,$newtext);
if($oldtitle){
    if($newtitle){
        if($newtext){
        $query=mysqli_query($conn,"SELECT*FROM news_table  JOIN user ON news_table.authorid=user.id WHERE title='$oldtitle' AND user.type!=9 OR news_table.image IS null");
        $numrows=mysqli_num_rows($query);
            if($numrows==1){
            mysqli_query($conn,"UPDATE news_table set title='$newtitle',news='$newtext' WHERE title='$oldtitle'");
            $query=mysqli_query($conn,"SELECT*FROM news_table WHERE title='$newtitle'");
            $numrows=mysqli_num_rows($query);
                if($numrows==1){
                    $errormsg2="News edited";
                }else
                $errormsg2="An error occurred.News not edited";
            }else
            $errormsg2="That news do not exist";
        }else
        $errormsg2="Please enter new text";
    }else
    $errormsg2="Please enter new title";
}else
$errormsg2="Please enter old news title";
}

Answer 1

我对您的代码进行了评论，看来您将允许任何user.type不等于9的用户执行编辑，也许您应该将其更改为= 9，因此只有user.type 9将是能够进行修改。

   if(isset($_POST['editsubmit'])){

// Post Variables 
$oldtitle=htmlentities($_POST['oldtitle']);
$newtitle=htmlentities($_POST['newtitle']);
$newtext=htmlentities($_POST['newtext']);
$oldtitle=mysqli_real_escape_string($conn,$oldtitle);
$newtitle=mysqli_real_escape_string($conn,$newtitle);
$newtext=mysqli_real_escape_string($conn,$newtext);

// If there is an oldtitle
if($oldtitle){
    // If there is a newtitle
    if($newtitle){
        // If there is newtext
        if($newtext){

        // Perform this query, JOIN and WHERE has user.type EQUALS 9
        $query=mysqli_query($conn,"SELECT*FROM news_table  JOIN user ON news_table.authorid=user.id WHERE title='$oldtitle' AND user.type = 9 OR news_table.image IS null");
        // Get the Data
        $numrows=mysqli_num_rows($query);
            // If we actually received a row with the matching criteria
            if($numrows==1){
            // Perform the update
            mysqli_query($conn,"UPDATE news_table set title='$newtitle',news='$newtext' WHERE title='$oldtitle'");
            // New query to refresh the data from the edit
            $query=mysqli_query($conn,"SELECT*FROM news_table WHERE title='$newtitle'");
            $numrows=mysqli_num_rows($query);
             // Verify the edit was completed
                if($numrows==1){
                    $errormsg2="News edited";
                }else
                $errormsg2="An error occurred.News not edited";
            }else
            $errormsg2="That news do not exist";
        }else
        $errormsg2="Please enter new text";
    }else
    $errormsg2="Please enter new title";
}else
$errormsg2="Please enter old news title";
}

用where子句加入两个表

1 个答案: