Question

我正在为用户创建一种编辑数据的方法。我的第一种方式是有效的，但后来我记得它非常不安全，我不应该直接将数据插入到数据库中;至少那是我所说的。我尝试通过执行VALUES（？，？，？，？，？）来使其更安全，以便数据不会直接进入，这似乎在我的注册页面中可以正常工作（如果你想要我可以包括）。

首先，这是我的原始更新数据页面工作正常，但它不使用（？，？，？，？，？）方法：

if(isset($_POST['submit'])) { 
    $userid=$_SESSION['userid'];
    $skype=$_POST['skype'];
    $email=$_POST['email'];
    $region=$_POST['region'];
    $crank=$_POST['league1'];
    $drank=$_POST['league2'];
        if(empty($skype) || empty($email) || empty($crank) || empty($drank) || empty($region))
        {
            echo "Cannot leave any field blank";
        }       
        else
        {   
            $host= "localhost";
            $dbname = "boost";
            $user = "root";
            $pwd = "";
            $port=3306; 

            try
            {
                $mysqli= new mysqli($host, $user, $pwd, $dbname,$port);
                if ($mysqli->connect_error) {
                die('Connect Error (' . $mysqli->connect_errno . ') ' . $mysqli->connect_error);
            }
            $query = "UPDATE usertable SET SkypeID = '$skype', Email = '$email', Region = '$region', CRank = '$crank', DRank = '$drank' WHERE UserID = '$userid'";
            $stmt = $mysqli->prepare($query);
            $stmt->bind_param("sssss",$skype,$email,$region,$crank,$drank); 
            $stmt->execute();
            $iLastInsertId=$mysqli->insert_id; 
            header('Location: http://localhost/Boost/account.php');
            $stmt->close(); 
            $mysqli->close();
        } catch (mysqli_sql_exception $e) { 
        throw $e; 
    } 
  }
}

以下是我尝试做的更安全的事情，但这似乎并不奏效。具体来说，$query = "UPDATE usertable SET usertable(SkypeID,Email,Region,CRank,DRank) VALUES (?,?,?,?,?) WHERE UserID = '$userid'";似乎是个问题，虽然语法对我来说很好

if(isset($_POST['submit'])) { 
    $userid=$_SESSION['userid'];
    $skype=$_POST['skype'];
    $email=$_POST['email'];
    $region=$_POST['region'];
    $crank=$_POST['league1'];
    $drank=$_POST['league2'];
        if(empty($skype) || empty($email) || empty($crank) || empty($drank) || empty($region))
        {
            echo "Cannot leave any field blank";
        }       
        else
        {   
            $host= "localhost";
            $dbname = "boost";
            $user = "root";
            $pwd = "";
            $port=3306; 

            try
            {
                $mysqli= new mysqli($host, $user, $pwd, $dbname,$port);
                if ($mysqli->connect_error) {
                die('Connect Error (' . $mysqli->connect_errno . ') ' . $mysqli->connect_error);
            }
            $query = "UPDATE usertable SET usertable(SkypeID,Email,Region,CRank,DRank) VALUES (?,?,?,?,?) WHERE UserID = '$userid'";
            $stmt = $mysqli->prepare($query);
            $stmt->bind_param("sssss",$skype,$email,$region,$crank,$drank); 
            $stmt->execute();
            $iLastInsertId=$mysqli->insert_id; 
            header('Location: http://localhost/Boost/account.php');
            $stmt->close(); 
            $mysqli->close();
        } catch (mysqli_sql_exception $e) { 
        throw $e; 
    } 
  }
}

所以我不确定问题是什么。根据我使用PHP的经验，语法应该没问题，但我必须遗漏一些东西。

Answer 1

实际上很简单，你来自

$query = "UPDATE usertable SET SkypeID = '$skype', Email = '$email', Region = '$region', CRank = '$crank', DRank = '$drank' WHERE UserID = '$userid'";

要

$query = "UPDATE usertable SET usertable(SkypeID,Email,Region,CRank,DRank) VALUES (?,?,?,?,?) WHERE UserID = '$userid'";

在重写时，您似乎混淆了INSERT语句与UPDATE语句，因此修复您只需使用旧样式的旧语句...

$query = "UPDATE usertable SET SkypeID = ?, Email = ?, Region = ?, CRank = ?, DRank = ? WHERE UserID = $userid";

无法为用户创建更新数据的安全方式

1 个答案: