Question

所以，我正在试图弄清楚这是怎么做的，这让我难以置信。这不会在网上使用，所以SQL注入我不会＃39;关心。我做错了什么/对吗？

    <?php
        $db = mysql_connect("localhost", "root", "root");
        if (!$db) {
            die("Database connect failed: " . mysql_error());
        }

        $db_select = mysql_select_db("UNii", $db);
        if (!$db_select) {
            die("Database selection failed: " . mysql_error());
        }

    $comment = $_GET['comment'];
    $id = $_GET['id'];

       $sql = "UPDATE Dbsaved SET comment = '{$comment}' WHERE id = $id";

        $comment1 = mysql_query($sql);

           if (!$comment1) {
               die("did not save comment: " . mysql_error());
           }

    echo $sql;

The main problem is with the statement itself, the connection is fine. I am trying to read $comment, and then update that into a MYSQL table and then have it read back in a different file.

编辑：标记表格我从中获取$评论。

<!DOCTYPE html>
<html lang="en">
<LINK href="stylesheet.css" rel="stylesheet" type="text/css">
<script src ="js/validateform.js"></script>
<head>
    <meta charset="UTF-8">

    <title>UniHelp Home</title>

    </head>

    <body>
        <div id="headeruni">
            <h1>Welcome <?php echo $_GET["name"]; ?> to UniHelp!</h1>
        </div>

    <div id ="infouni">
        <h3>Welcome to UniHelp. The social Network getting you connected to other people all over the University for any help you require!</h3>
    </div>

  <div id ="nameandemail">
        <form action="formsend.php" method="post">
            First name: <br> <input type="text" name="name"><br>
            Email:  <br> <input type="text" name="email"><br>
            Comment: <br> <input type="text" name="message"><br>
            <input type="submit" name="submit">
        </form>`enter code here`
       </div>
    <div id="grabphpdiv">

        <?php
        $db = mysql_connect("localhost", "root", "root");
        if (!$db) {
            die("Database connect failed: " . mysql_error());
        }

        $db_select = mysql_select_db("UNii", $db);
        if (!$db_select) {
            die("Database selection failed: " . mysql_error());
        }
        $result = mysql_query("SELECT * FROM Dbsaved", $db);
        if (!$result) {
            die ("Database query failed: " . mysql_error());
        }

    $comment = $_POST['$comment'];

        while ($row = mysql_fetch_array($result)) {
            echo "<div id='posts'>";;
            echo "<h2>";
            echo $row[1] . "";
            echo "</h2>";
            echo "<p>";
            //echo $timestamp = date('d-m-y G:i:s ');
            echo "<br>";
            echo "<br>";
            echo $row[2] . "";
            echo "</p>";
            echo "<p>";
            echo $row[3] . "";
            echo "</p>";
            echo '<a href=delete.php?id=' . $row[0]. '">Delete</a>';
            echo "<br>";
            echo "<br>";
            echo 'Comment: <br>
                           <input type=text name=comment><br>
                           <a href=addcomment.php?id=' . $row[0]. '&comment='. $row['$comment'].'>Comment</a>';
            echo "<p>";
            echo $row['comment'] . "";
            echo "</p>";
            echo "</div>";
            echo "<br>";
        }
        ?>
        </div>
</body>

<div id="footer">Copyright &copy James Taylor 2016</div>
</html>

Answer 1

我刚刚运行了这段代码：

Hello world !
Hello subworld !
Hello sub-subworld !

并且看到了：

$comment = "Hello World!";
$id = 1;
$sql = "UPDATE Dbsaved SET comment = '{$comment}' WHERE id = {$id}";
echo $sql;

这是一个正确的SQL语句，所以如果它不起作用，你可能想直接使用SQL来获得一些工作。希望有所帮助！

Answer 2

解决方案：

$comment = $_GET['$comment'];
$id = $_GET['$id'];

        while ($row = mysql_fetch_array($result)) {
            echo "<div id='posts'>";;
            echo "<h2>";
            echo $row[1] . "";
            echo "</h2>";
            echo "<p>";
            //echo $timestamp = date('d-m-y G:i:s ');
            echo "<br>";
            echo "<br>";
            echo $row[2] . "";
            echo "</p>";
            echo "<p>";
            echo $row[3] . "";
            echo "</p>";
            echo '<a href=delete.php?id=' . $row[0]. '">Delete</a>';
            echo "<br>";
            echo "<br>";
            echo $row[4] . "";
            echo "<br>";
            echo 'Comment: <br>
                           <form action="addcomment.php?id=' . $row[0]. '" method="post">
                           <input type=text name=comment><br>
                           <input type=submit name="submit">
                           </form>';
            echo "<p>";
            echo $row['comment'] . "";
            echo "</p>";
            echo "</div>";
            echo "<br>";
        }
        ?>

和

<?php
        $db = mysql_connect("localhost", "root", "root");
        if (!$db) {
            die("Database connect failed: " . mysql_error());
        }

        $db_select = mysql_select_db("UNii", $db);
        if (!$db_select) {
            die("Database selection failed: " . mysql_error());
        }

    $comment = $_POST['comment'];
    $id = $_GET['id'];

       $sql = "UPDATE Dbsaved SET comment = '$comment' WHERE id = $id ";

        $comment1 = mysql_query($sql);

    echo $sql;

           if (!$comment1) {
               die("did not save comment: " . mysql_error());
           }
    else {
    header("location: UniHelpindex.php");
    }

主要是需要在while循环中创建的表单中获取id中使用的$row[0]'。实际上使用update Dbsaved...位的正确语法。

UPDATE数据库中的单列：PHP＆amp; MYSQL

2 个答案: