PHP 多种形式，第二个使用第一个的数据

Question

我试图首先获取一个 ID 来查询数据库并将结果打印在表中(这部分有效)。然后我想获取用户提供的 id，并使用它使用 PHP 更新数据库中的信息。我想使用第二种形式的输入作为更新数据库的值。要更改的表是 customers，它包含字段 ID、NAME、ADDRESS。我不希望用户能够更改 ID。

表格 1:

<form method="post" action="">
    <p style="margin-top: 70px;">Please type the ID of the person you wish to add to change their data</p>
    <p style="margin-bottom: 0px;">ID</p>
    <input style="color:black" type="text" name="id" placeholder="10001">
    <input style="color:lightblue;background-color: rgb(80,80,80);margin-top: 7px; " type="submit" value="Submit">
</form>

表格 2:

<form method="post" action="">
    <p>New Information for Customer with ID entered above</p>
    <input style='color:black;' type='text' name='newName' placeholder='Name Change'>
    <input style="color:black;" type="text" name="newAddress" placeholder="New Address">
    <input style="color:lightblue;background-color: rgb(80,80,80);margin-top: 7px; " type="submit" name="submitForm2" value="Submit">
</form>

这是我当前请求的 php，但它不起作用，检查值是否已设置的 $_POST 返回 false。

<?php 
            session_start();
            if (isset($_POST["id"])){
                $servername = 'localhost';
                $user = 'root';
                $pass = '';
                $db = 'the_sports_store';
                $conn = new mysqli($servername,$user, $pass, $db);

                // Check connection
                if ($conn->connect_error) {
                    echo '<script language="javascript">';
                    echo 'alert("DB Connection Failed:")';
                    echo '</script>';
                    die("" . $conn->connect_error);
                } 

                $sessionID = $_SESSION["ID"];
                $newName = $_SESSION["newName"];
                $newAddress = $_SESSION["newAddress"];
                var_dump($newName);

                $sql = "SELECT * FROM `customers` WHERE ID='$sessionID';";


                //display the current record, allow user input to alter it, then display new data
                if ($conn->query($sql) == TRUE) {
                    echo"<div class='col-10'>";
                    echo"<table>";
                    echo"<tr>
                            <td align='justify'><b>ID</b></td>
                            <td align='justify'><b>NAME</b></td>
                            <td align='justify'><b>ADDRESS</b></td>
                         </tr>";
                    $result = mysqli_query($conn, $sql);
                    $row = mysqli_fetch_assoc($result);
                    echo "<tr><td style='padding: 10px;'>{$row['ID']}</td><td>{$row['NAME']}</td><td>{$row['ADDRESS']}</td></tr>";
                    echo "</table>";
                    echo "</div>";





                    if(!empty($_POST["newName"]) && !empty($_POST["newAddress"])){
                        echo '<script language="javascript">';
                        echo 'alert(',$sessionID,');';
                        echo '</script>';
                        $newName = $_POST["newName"];
                        $newAddress = $_POST["newAddress"];
                        $sqlChange = "UPDATE `customers` 
                                        SET `NAME` = '$newName', `ADDRESS` = '$newAddress' 
                                        WHERE `ID` = '$sessionID';";

                        if ($conn->query($sqlChange) === TRUE) {
                            echo '<script language="javascript">';
                            echo 'alert("Update Successful.")';
                            echo '</script>';
                        } else {
                            echo '<script language="javascript">';
                            echo 'alert("Error. Update Unsucessful.")';
                            echo '</script>';
                        }

                    }else if(!empty($_POST["newName"])){
                        $newName = $_POST["newName"];
                        $sqlChange = "UPDATE `customers` SET `NAME` = '$newName' WHERE `ID` =  '$sessionID'";
                        echo '<script language="javascript">';
                        echo 'alert(',$newName,');';
                        echo '</script>';

                        if ($conn->query($sqlChange) === TRUE) {
                            echo '<script language="javascript">';
                            echo 'alert("Update Successful.")';
                            echo '</script>';
                        } else {
                            echo '<script language="javascript">';
                            echo 'alert("Error. Update Unsucessful.")';
                            echo '</script>';
                        }
                    }else if(!empty($_POST["newAddress"])){
                        $newName = $_POST["newAddress"];
                        $sqlChange = "UPDATE `customers` SET `ADDRESS` = '$newAddress' WHERE `ID` =  '$sessionID'";

                        echo '<script language="javascript">';
                        echo 'alert(',$sessionID,');';
                        echo '</script>';

                        if ($conn->query($sqlChange) === TRUE) {
                            echo '<script language="javascript">';
                            echo 'alert("Update Successful.")';
                            echo '</script>';
                        } else {
                            echo '<script language="javascript">';
                            echo 'alert("Error. Update Unsucessful.")';
                            echo '</script>';
                        }
                    } else{
                        echo '<script language="javascript">';
                        echo 'alert(',$sessionID,');';
                        echo '</script>';
                    }
                }
                $conn->close();
            }

        ?>

Answer 1

您的问题是您的 PHP 代码只有在设置了 id 时才会执行。因此，当您发布第二个表单时，代码将永远不会执行。

将此 if (!empty($_POST["newName"]) && !empty($_POST["newAddress"])) 和所有 elseif/else 移至初始 if 之外。

此外，我觉得有义务告知您有关 SQL 注入(inject)以及如何避免它的信息:How can I prevent SQL injection in PHP?