php - SQL 语法错误 IN

Question

我正在编写一个脚本来确定是否对我的数据进行了更改。

但是我收到了这个错误:

Error: UPDATE Workhours SET IN= '07:59' WHERE AFNumber='AF1585' AND Date='09/07/2015' You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'IN= '07:59' WHERE AFNumber='AF1585' AND Date='09/07/2015'' at line 1Error: UPDATE Workhours SET OUT= '14:04' WHERE AFNumber='AF1585' AND Date='09/07/2015'

有什么帮助吗？

if (isset($_POST['submit'])) 
    {
        $sql = "SHOW COLUMNS FROM Workhours";
        $result = mysqli_query($con,$sql);
         while($row = mysqli_fetch_array($result)){
                    $tempname = $row['Field'];
                    $sql2 = "UPDATE Workhours SET ".$row['Field']."= '$_POST[$tempname]' WHERE AFNumber='".$_GET["af"]."' AND Date='".$_GET["date"]."'";
                    $result2 = mysqli_query($con,$sql2);
                    if ($con->query($sql2) === TRUE) {
                    } else {
                        echo "Error: " . $sql2 . "<br>" . $con->error;
                    }
        }
         $sql3 = "SELECT * FROM Workhours WHERE AFNumber='".$_GET["af"]."' AND (".$row['Field']." NOT LIKE '".$_POST[$tempname]."')";
                    $result3 = mysqli_query($con,$sql3);
                    if (mysqli_num_rows($result3) > 0) {
                    // output data of each row
                    while($row3 = mysqli_fetch_array($result3)) {
                        $sql3 = "INSERT INTO `Changes` (`Table`, `AFNumber`, `Attribute`, `DateChanged`, `HRUser`, `OldValue`, `NewValue`)

    VALUES ('Workhours', '".$_GET["af"]."', '".$row["Field"]."', '".date('dd/m/Y HH:mm:ss')."', '$login_session', '', '$_POST[$tempname]')";

                        if (mysqli_query($con,$sql3) === TRUE) {
                        } else {
                        echo "Error: " . $sql3 . "<br>" . mysqli_error($con);
                        }
                    }
                    }

         echo '<script>swal("Success", "Changes have been saved", "success");</script>';

    }    

Answer 1

IN 和 OUT 是 keywords在 MySQL 中。您必须使用反引号转义 $row['Field']。

$sql2 = "UPDATE Workhours SET `".$row['Field']."`= '$_POST[$tempname]' WHERE AFNumber='".$_GET["af"]."' AND Date='".$_GET["date"]."'";

您还应该使用准备好的语句来防止 SQL 注入(inject)。