Question

我想创建一个可以更新数据库的表单。我希望用户从列表中选择名称，然后在提交时输入新值，在表格中，将修改所选的名称。

FORM

<!DOCTYPE html>

      <html>
     <head>
<title>Logging | Warriors Elite</title>
    <script src='https://code.jquery.com/jquery-2.1.3.min.js'></script>
 </head>

      <body><h1>Update Opposition War Details</h1>
          <form method = "post" action = "updateopponent.php">
 <p>Player Name: <select name="Name">

<?

  $con = mysql_connect("localhost","db","pswd");

    if (!$con)
 {
     die('Could not connect: ' . mysql_error());
}

// Select database
mysql_select_db("978947") or die(mysql_error());

        $cdquery="SELECT Name FROM opponent";
        $cdresult=mysql_query($cdquery) or die ("Query to get data from firsttable failed: ".mysql_error());

        while ($cdrow=mysql_fetch_array($cdresult)) {
        $cdTitle=$cdrow["Name"];
            echo "<option>
                $cdTitle
            </option>";

        }

        ?>
 </select>
</p>

<p>Clan Best Attacker
<input placeholder='#. Name' type='text' name='CBA' id='CBA' />
</p>


<p>Percentage(%)
<input type='text' name='percent' id='percent' />
</p>


<p>Stars Achieved
<input type='text' name='star' id='star' />
</p>

<button id='insert'>Submit</button>

<p id='result'></p>
</form>
        <?php
     }
  ?>

PHP

 <?php
      define('HOST','localhost');
   define('USERNAME', 'db');
   define('PASSWORD','pswd');
  define('DB','');

 $con = mysqli_connect(HOST,USERNAME,PASSWORD,DB);


     $sql="UPDATE opponent SET Clan Best attack='".$_POST['CBA']."', Stars Achieved='".$_POST['star']."', Damage percentage='".$_POST['percent']."'         WHERE   Name='".intval($_REQUEST['Name'])."'";
        $result=mysql_query($sql)or 
        die ("this stuffedup");

        mysql_close($conn);
        ?>

我能够连接到数据库，但点击提交失败（这个填充）

Answer 1

您无法在列名中使用空格而无需回溯它们：

$sql = "
UPDATE opponent
SET `Clan Best attack`='" . mysqli_real_escape_string($con, $_POST['CBA']) . "', 
    `Stars Achieved`='" . mysqli_real_escape_string($con, $_POST['star']) . "', 
    `Damage percentage`='" . mysqli_real_escape_string($con, $_POST['precent']) . "'         
WHERE `Name`='" . intval($_REQUEST['Name']) . "'
";

btw：mysql非常过时。你想用mysqli代替。 btw2：您可能还想保护数据库免受注入。例如mysqli_real_escape_string（$ con，$ userInput）

使用PHP和HTML表单更新SQL数据库中的数据

1 个答案: