这个PHP代码有什么问题吗?

时间:2015-11-14 19:49:24

标签: php database

这段代码是正确的语法吗?

我需要更新数据库中某一行的某些字段,我可以使用电子邮件进行访问...这是对的吗?

public function storeData($emaill, $servicee, $ratee, $rated_clientss) {
    $email = "samy@gmail.com";
    $service = "lksdjfsdkljf";
    $rate = "good";
    $rated_clients = "20";
    $stmt = $this->conn->prepare ( "UPDATE users SET service='$service' and SET rate='$rate' and SET rated_clients='$rated_clients' WHERE email='$email'" );
    var_dump($stmt->execute ());

    if ($stmt->execute ()) {
        $data = $stmt->get_result ()->fetch_assoc ();
        $stmt->close ();
        return $data;
    } else {
        return NULL;
    }
}

1 个答案:

答案 0 :(得分:1)

准备好的语句不能直接接受用户输入,而是需要将它们作为占位符传递:?,然后使用bind_param()填写类型和变量。

观察:

$stmt = $this->conn->prepare ( "UPDATE users SET service=? and SET rate=? and SET rated_clients=? WHERE email=?" );
$stmt->bind_param('ssss', $service, $rate, $rated_clients, $email);

现在您可以正确->execute $stmt