php - UPDATE MySQL 有时只能工作。不是每次

Question

我正在制作一个非常简单的网站，该网站将显示在办公室的电视上。 index.php 页面是一个表单，它有三个字段。表单方法是 post 并且那里的一切都是正确的。

然后我在下一页上有这段代码，提交后表单指向的那一页。

 mysql_select_db("figs", $con);

mysql_query("UPDATE stats SET slots_sold=$_POST[slots_sold], total_figure=$_POST[total_figure], apps_sat=$_POST[apps_sat]");


mysql_close($con);
?>

问题是表格有时会更新，有时不会，有人知道为什么吗？这真的很简单，我认为它会很有魅力。

Answer 1

您没有验证任何传递的数据。此外，我建议对准备好的语句使用 MySQLi 以使事情更安全。

// create a new MySQLi object
$mysqli = new mysqli('host', 'user', 'password', 'database');

// create var for each POST array item you need
$slots_sold   = $_POST['slots_sold'];
$total_figure = $_POST['total_figure'];
$apps_sat     = $_POST['apps_sat'];

//check to make sure each field is set
if(isset($slots_sold) && isset($total_figure) && isset($apps_sat))
{    
     // prepare mysqli statement for your data
     if($stmt->prepare("UPDATE stats SET `slots_sold` = ?, `total_figure` = ?, `apps_sat` = ?"))
     {  
         // bind each variable to query, respectively (? is place holder for var)
         // s = string ('sss' means three strings). i = integer if needed
         $stmt->bind_param('sss', $slots_sold, $total_figure, $apps_sat);
         $stmt->execute(); // execute your query
     }
     else
     {
         $stmt->error; // there was an error with the query, show the error
     }
}
else
{
     echo 'You did not fill out all of the fields.';
}

$stmt->close; // close mysqli connection

希望对您有所帮助。根据您传递的数据，我会使用 preg_match 检查每个数据。以下是一些非常简单的正则表达式，可帮助您入门:

/[a-zA-Z ]+/     (Any letter, lowercase or uppercase including spaces atleast once)
/[a-zA-Z]+/      (Same as above, without spaces atleast once)
/[a-zA-Z0-9]+/   (Any letter, lowercase or uppercase including numbers atleast once)
/[0-9]+/         (Any number atleast once)

preg_match('/[a-zA-Z]+/', $str, $matches); // you can throw this in a for loop to check each var if they all require the same pattern