php - php/mysql 更新新手

Question

我的网站第一页显示了我公司的所有员工。我想使用表格更新我在那里的信息。我拥有一切都很好，只是要让它变得完美。 :p

我有一个应该更新它的函数，但它没有。

  public function writeStaff($p) {
  if ( $_POST['uid'] )
  $uid = mysql_real_escape_string($_POST['uid']);
if ( $_POST['level'] )
  $level = mysql_real_escape_string($_POST['level']);
if ( $_POST['name'] )
  $name = mysql_real_escape_string($_POST['name']);
if ( $_POST['pic'] )
  $pic = mysql_real_escape_string($_POST['pic']);
if ( $_POST['job'] )
  $job = mysql_real_escape_string($_POST['job']);
if ( $_POST['about'] )
  $about = mysql_real_escape_string($_POST['about']);
if ( $_POST['contact'] )
  $contact = mysql_real_escape_string($_POST['contact']);
if ( $_POST['links'] )
  $links = mysql_real_escape_string($_POST['links']);
if ( $_POST['username'] )
  $username = mysql_real_escape_string($_POST['username']);
if ( $_POST['password'] )
  $password = mysql_real_escape_string($_POST['password']);
if ( $uid ) {
$sql = "UPDATE staff SET level = $level, name = $name, pic = $pic, job = $job, about = $about, conact = $contact, links = $links, username = $username, password = $password WHERE uid = $uid";
 return mysql_query($sql);
} else {
  return false;
}
}

<小时/>

接下来，我有表格，

    public function display_admin_staff() {
$uid = $_SESSION['uid'];
$name = $_SESSION['name'];
$Job = $_SESSION['jobs'];
$about = $_SESSION['about'];
$pic = $_SESSION['pic'];
$contact = $_SESSION['contact'];
$level = $_SESSION['level'];
$links = $_SESSION['links'];
$username = $_SESSION['username'];
$password = $_SESSION['password'];
    return <<<ADMIN_FORM_STAFF

    <form action="/staff/$uid" method="post">
<input name="uid" type="hidden" value="$uid" />
    <fieldset>
<legend><span>Add Staff</span></legend>
<ul>
<li class="input"><label for="name">Name:</label><input name="name" id="name" type="text" size="50" value="$name"/></li>
<li class="input"><label for="level">Level:</label><input name="level" id="level" type="text" size="50" value="$level"/></li>
<li class="input"><label for="pic">Pic:</label><input name="pic" id="pic" type="text" size="50" value="$pic"/></li>
<li class="input"><label for="job">Job:</label><input name="job" id="job" type="text" size="50" value="$job"/></li>
<li class="input"><label for="about">About:</label><textarea class="resizable" name="about" id="about" style="width:267px; height:300px; resize: none;">$about</textarea></li>
<li class="input"><label for="contact">Email:</label><input name="contact" id="contact" type="text" size="50" value="$contact"/></li>
<li class="input"><label for="links">Links:</label><input name="links" id="links" type="text" size="50" value="$links"/></li>
<li class="input"><label for="username">Username:</label><input name="username" id="username" type="text" size="50" value="$username"/></li>
<li class="input"><label for="password">Password:</label><input name="password" id="password" type="password" size="50" value="$password"/></li>
</ul>
</fieldset>
<ul class="actions">
<li><button type="submit" id="complete" name="submit" class="button" value="Create This Entry!"><span>Create Staff Member!</span></button></li>
</ul>

     ADMIN_FORM_STAFF;
    }

<小时/>

然后，我把一切都放在一起......

  $obj = new simpleCMS();

  /* CHANGE THESE SETTINGS FOR YOUR OWN DATABASE */
  $obj->host = 'localhost';
  $obj->username = 'root';
  $obj->password = 'root';
  $obj->table = 'rrdcms';
  $obj->connect();

  if ( $_POST )
    $obj->writeStaff($_POST);

  echo $obj->display_admin_staff();

Answer 1

您仍然必须在查询字符串中用引号将所有变量括起来，否则您只是粘贴裸字符串，从而导致语法错误。

INSERT INTO ... (...) VALUES ('$var1', '$var2', '$var3') etc...
UPDATE ... SET field='$var1', field2='$var2', etc...

mysql_real_escape_string 不会为您添加这些引号。它只是确保它转义的任何内容在查询字符串中使用都是“安全的”。

如果 mysql_query() 返回 false，则意味着出现问题，您可以使用 mysql_error() 获取准确的描述/错误消息。