Question

我一直试图切换到准备好的语句，但是我无法弄清楚为什么我的新代码不再起作用。我是新手使用这些并仍在学习，但我知道这是安全的最佳实践。任何帮助，将不胜感激。谢谢。

<?php
$servername = "11.11.11.11";
$username = "root";
$password = "root";
$dbname = "sit";

$conn = new mysqli($servername, $username, $password,$dbname);


if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
echo "Connected successfully";
$result = mysqli_query($conn, "SELECT * FROM `ourstory` ");
$values = mysqli_fetch_array($result);


if(isset($_POST['ourstory_title'])){
$ourstory_title = $_POST['ourstory_title'];
$ourstory_testimonial = $_POST['ourstory_testimonial'];
$ourstory_content = $_POST['ourstory_content'];
$ourstory->execute();

$ourstory = $conn->prepare("UPDATE ourstory SET
    ourstory_title='$ourstory_title' ,
    ourstory_content='$ourstory_content' ,
    ourstory_testimonial='$ourstory_testimonial' 
    WHERE  ourstory_id='1'");
$ourstory->bind_param("sss", $ourstory_title, $ourstory_content, $ourstory_testimonial);   




if (mysqli_query($conn, $ourstory)) {
    echo "Record updated successfully";
} else {
    echo "Error updating record: " . mysqli_error($conn);
}   
$ourstory->close();
$conn->close();

}

?>
<form id="comment_form" method="post" 
      action="<?php echo $ourstory?>" 
      onsubmit="setTimeout(function () { 
             window.location.reload(); 
      }, 10), location.reload(true);">

<table width="100%" border="0" cellspacing="1" cellpadding="2">


<tr>
<td width="85%">About Us Title</td>
</tr>
<tr>
<td>
   <input class="commentarea" 
          name="ourstory_title" type="text" 
          id="ourstory_title" value="<?php echo $values['ourstory_title']?>">
</td>
</tr>
<tr>
<td width="85%" >Testimonial</td>
</tr>
<tr>
<td>
   <pre>
     <textarea class="commentarea" 
      name="ourstory_testimonial" type="text" 
      id="ourstory_testimonial" rows= "10" ><?php echo $values['ourstory_testimonial']?>
     </textarea>
   </pre>
</td>
</tr>
<tr>
<td width="85%" >About Us Content</td>
</tr>
<tr>
<td>
  <pre>
    <textarea class="commentarea" name="ourstory_content" 
        type="text" id="ourstory_content"  
         rows= "10" ><?php echo $values['ourstory_content']?>
    </textarea>
  </pre>
 </td>
</tr>


<tr>

<td>

<input type="submit" value="Update">
</td>
</tr>
</table>
</form>

Answer 1

结合Mark的回答，我提交以下内容作为补充答案，并使用我在OP的问题下留下的一些评论。

首先，<textarea>没有类型。 type="text"删除所有这些。

然后，$ourstory->execute();放错了位置，一旦您使用了Mark的答案并使用了答案和手册http://www.php.net/manual/en/mysqli.quickstart.prepared-statements.php $ourstory->bind_param("sss",...之后>

您不应该在条件语句中使用if (mysqli_query($conn, $ourstory)) { affected_rows printf("Affected rows (UPDATE): %d\n", $ourstory->affected_rows); $ourstory->execute(); http://php.net/manual/en/mysqli.affected-rows.php来检查查询是否确实成功。

从您的修改：https://stackoverflow.com/revisions/31003865/4

$ourstory->execute();
printf("Affected rows (UPDATE): %d\n", $ourstory->affected_rows);

执行后需要执行：

if

但我会为使用条件int $mysqli->affected_rows;，它应该是连接的变量，即来自手册：

printf("Affected rows (UPDATE): %d\n", $conn->affected_rows);

所以：

<?php
$mysqli = new mysqli("localhost", "my_user", "my_password", "world");

/* check connection */
if (mysqli_connect_errno()) {
    printf("Connect failed: %s\n", mysqli_connect_error());
    exit();
}

/* Insert rows */
$mysqli->query("CREATE TABLE Language SELECT * from CountryLanguage");
printf("Affected rows (INSERT): %d\n", $mysqli->affected_rows);

http://php.net/manual/en/mysqli.affected-rows.php

手册中的示例：

$.ajaxSetup({
    // Disable caching of AJAX responses
    cache: false
});

Answer 2

$ourstory = $conn->prepare("UPDATE ourstory SET ourstory_title='$ourstory_title' ,ourstory_content='$ourstory_content' ,ourstory_testimonial='$ourstory_testimonial' WHERE  ourstory_id='1'");
$ourstory->bind_param("sss", $ourstory_title, $ourstory_content, $ourstory_testimonial);

如果您将值绑定到预准备语句，则需要在该查询中设置占位符....不要自己注入值然后尝试绑定它们

$ourstory = $conn->prepare("UPDATE ourstory SET ourstory_title=? ,ourstory_content=? ,ourstory_testimonial=? WHERE  ourstory_id='1'");
$ourstory->bind_param("sss", $ourstory_title, $ourstory_content, $ourstory_testimonial);

您也可以绑定ourstory_id的值

准备好的语句没有运行MYSQLI PHP

2 个答案: