Question

我有这个类用于执行查询 - 插入，删除，删除创建等，但这次我创建了一个方法来更新表，当更新已提交时，我惊讶和几个小时的头痛它返回成功但实际上没有更新数据库中的记录是如此困惑，我已经调试了几个小时无济于事所以我决定分享我的担忧，看看我是否可以获得帮助，因为我实际上是2周大的OOP PHP

所以我的班级

   class queryClass extends MYSQL{ //MYSQL is for connecting to database 
        //table fields
        var $user_table = '';          //table names that will be used in all names, each query method will input its own table name

        //connect to database
            function dbconnect(){
                 MYSQL::dbconnect();
            }
          //prevent injection
       function qry($query) {
          $this->dbconnect();
         $args  = func_get_args();
          $query = array_shift($args);
          $query = str_replace("?", "%s", $query);
          $args  = array_map('mysql_real_escape_string', $args);
          array_unshift($args,$query);
          $query = call_user_func_array('sprintf',$args);
          $result = mysql_query($query) or die(mysql_error());
              if($result){
                return $result;
              }else{
                 $error = "Error";
                 return $result;
              }
             //update quote function
    function updatequote($table, $message1, $message2, $column_name1, $column_name2, $column_name3, $quote_id){
         $this->dbconnect();
         $this->quote_id = $quote_id; 
        echo $message1, $message2;

        //make sure table name is set
          $this->user_table = $table;
          $this->column_name1 = $column_name1;
           $this->column_name2 = $column_name2;
         $this->column_name3 = $column_name3;

        //execute login via qry function that prevents MySQL injections
        $result = $this->qry("UPDATE ".$this->user_table." SET ".$this->column_name2."='?', ".$this->column_name3."='?'
        WHERE ".$this->column_name1."='?';", $message1, $message2, $this->quote_id );
       // $result = mysql_query("INSERT INTO ".$this->user_table."(username, password) VALUES('$username', '$password')");
      if($result){
     $_SESSION['success'] = "The Update Was Successfully Saved";
       header('location: edit_quotes.html');

       exit();
        return true; 
    }else{
      $_SESSION['success'] = "The Update Was Not Saved".mysql_error();
       header('location: edit_quotes.html'); 
       exit();   //do something on FAILED login
        return false;
    }
        }

         //quote form
        function quoteEditorform($formname, $formclass, $formaction, $helptext, $first, $second){
            //conect to DB
            $this->dbconnect();

            echo"
    <form name=\"$formname\" method=\"post\" id=\"$formname\" class=\"$formclass\" enctype=\"application/x-www-form-urlencoded\" action=\"$formaction\">

    <h2>$helptext</h2>
    <div><label for=qoute>NGWA QUOTE 
    <input type=button value='Quote' onclick=\"wrapInTags(this.form.message1,'quote')\">insert [quote].[/quote]tags
     </label>
    <textarea name=\"message1\" cols=\"40\" rows=\"4\" onclick=\"copySelection(this)\">$first</textarea><br>
    </div>
    <div><label for=\"qoute\">ENGLISH MEANING
    <input type=button value='Meaning' onclick=\"wrapInTags(this.form.message2,'meaning')\">
    insert [meaning].[/meaning]tags
    </label>
    ".$record['meaning']."
    <textarea name=\"message2\" cols=\"40\" rows=\"4\" onclick=\"copySelection(this)\">$second</textarea></div>
    <input name=\"action\" id=\"action\" value=\"sendeditedquote\" type=\"hidden\">
    <div>

    <input name=\"submit\" id=\"submitV value=\"Save\" type=\"submit\"></div>

    </form>
    <div align=\"center\"><a href=\"edit_quotes.html?do=read_bb_codes\">Read Before Posting</a></div>
    ";    }     

        function createquotetable($tablename){
        //connect to DB
        $this->dbconnect();
        $qry = "CREATE TABLE IF NOT EXISTS ".$tablename."(
    quote_id        INT(8) NOT NULL AUTO_INCREMENT,
    ngwaquote           TEXT NOT NULL,
    meaning         TEXT NOT NULL,
    saved_date      date, 
    PRIMARY KEY (quote_id)
    ) TYPE=INNODB
        ";
        $result = $this->qry($qry);
            return;
        }

包含我的班级文件后，这是我的quote-editor.html

 // instantiate all other needed classes
$cleaner = new cleanPost();
$connect = new MySQL();
$connect->dbconnect();// connect to a database
$bbcode = new BBCode(); 
$log = new logmein();

    if($_REQUEST['action'] == "sendeditedquote"){
  //post all the values to the database using our main class

/*topic field checking */
        if($_REQUEST['message1'] == "" || $_REQUEST['topic'] > 600) {
        $errmsg_arr[] = 'Sorry You Can\'t Send An Empty Qoute OR quote greater than 500 characters at a time';
        $errflag = true;
                                                                    }                                           

        if($_REQUEST['message2'] == "" ) {
        $errmsg_arr[] = 'Sorry You Can\'t Update With An Empty Qoute';
        $errflag = true;
                                        }

            //If there are input validations, redirect back 
    if($errflag) {
        $_SESSION['ERRMSG_ARR'] = $errmsg_arr;
        session_write_close();
        header("location: edit_quotes.html");
        exit();
                 }
 $log->updatequote("quotes", $_REQUEST['message1'], $_REQUEST['message2'], "quote_id", "ngwaquote", "meaning", $cleaner->clean($_GET['quote_id']));

}

ai'ght当我执行查询时，成功/错误行返回更新成功，但在另一页显示所有可用的引号，特定报价仍未更新

任何经历过这种情况的人请告诉我他们做了什么。

向RAW QUERY询问了这条线就这个- 首先是清理我的帖子并使用$this->qry(somequeries here)

进行查询的方法

function qry($query) {
              $this->dbconnect();
             $args  = func_get_args();
              $query = array_shift($args);
              $query = str_replace("?", "%s", $query);
              $args  = array_map('mysql_real_escape_string', $args);
              array_unshift($args,$query);
              $query = call_user_func_array('sprintf',$args);
              $result = mysql_query($query) or die(mysql_error());
                  if($result){
                    return $result;
                  }else{
                     $error = "Error";
                     return $result;
                  }

     //update quote function using $this->qry()
        function updatequote($table, $message1, $message2, $column_name1, $column_name2, $column_name3, $quote_id){
             $this->dbconnect();
             $this->quote_id = $quote_id; 
            echo $message1, $message2;

            //make sure table name is set
              $this->user_table = $table;
              $this->column_name1 = $column_name1;
               $this->column_name2 = $column_name2;
             $this->column_name3 = $column_name3;

            //execute login via ****qry function**** that prevents MySQL injections
            $result = $this->qry("UPDATE ".$this->user_table." SET ".$this->column_name2."='?', ".$this->column_name3."='?'
            WHERE ".$this->column_name1."='?';", $message1, $message2, $this->quote_id );
           // $result = mysql_query("INSERT INTO ".$this->user_table."(username, password) VALUES('$username', '$password')");
          if($result){
         $_SESSION['success'] = "The Update Was Successfully Saved";
           header('location: edit_quotes.html');

           exit();
            return true; 
        }else{
          $_SESSION['success'] = "The Update Was Not Saved".mysql_error();
           header('location: edit_quotes.html'); 
           exit();   //do something on FAILED login
            return false;
        }
            }

Answer 1

如果update语句的where子句与任何行都不匹配，update语句将返回成功。
但是它不会改变任何东西请注意，MySQL知道值何时没有真正改变，所以语句

UPDATE table1 SET col1 = 0 WHERE col1 = 0

对于受影响的行数，将始终返回0。

如果您想知道是否有任何更改，您需要致电：

$rows_updated = mysql_affected_rows($this->connection);
or
$rows_updated = mysqli_affected_rows($this->connection);  //if you're using mysqli

更新语句仅表示失败是发生错误。

关于SQL注入的警告
我注意到你使用动态表和列名称如果这些值以任何方式由用户改变或通过可能受用户影响的另一个php会话影响的超全局，则会有一个SQL注入漏洞。

以下是如何保护自己：How to prevent SQL injection with dynamic tablenames?

Answer 2

我想我找到了问题的答案在我有$this->quote_id的地方我后来发现页面编辑器网址是editor.html?quote_id=1 然后，当我提交它时，现在将在平面网址上处理表单=== editor.html所以我的错误是当我还在编辑网址editor.html?quote_id=1时我没有请求QUOTE ID在不可能的情况下请求它，即在editor.html中，因此它意味着返回我用来更新的空引用ID，从而导致更新成功，但没有真正更新任何内容所以我所做的只是添加一个隐藏的输入标签，以便编辑quote_id，然后将其与表单的其余部分一起发布

这么简单但是花了我几个小时的重读和重新编码，很棒，小事引起很多挫折

全部谢谢

Answer 3

如果您要更新的字段与数据库中的字段不同，则不会更新。虽然它返回成功简单意味着它看到了表并连接到数据库

什么可以使更新查询不更新但返回成功

3 个答案: