php - 更新查询事项

Question

我在我的网站中定义了一个用户设置页面，该页面上出现了几个表单，我编写了一个查询，以便在单击“提交”按钮时更新这些字段，但我如何最终出现以下错误；

User Could Not Be Updated Because:You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'SHA1(5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8)', ' WHERE id =' at line 1

这是表单的个人资料设置页面代码:

    <?php

    $uid = $_SESSION['user_id'];
    $query = mysqli_query($dbc, "SELECT * FROM users WHERE id = $uid ")or die(mysql_error());

    $arr = mysqli_fetch_assoc($query);

     ?> 

    <form action="?page=profileset&id=<?php echo $arr['id']; ?>" method="post" role="form">

            <label for="first">First Name</label>
            <input class="form-control" type="text" name="first" id="first" value="<?php echo $arr['first']; ?>" placeholder="First Name" autocomplete="off">

        </div>

        <div class="from-group">

            <label for="last">Last Name</label>
            <input class="form-control" type="text" name="last" id="last" value="<?php echo $arr['last']; ?>" placeholder="Last Name" autocomplete="off">

        </div>

        <br>

        <div class="from-group">

            <label for="email">Email Address</label>
            <input class="form-control" type="text" name="email" id="email" value="<?php echo $arr['email']; ?>" placeholder="Email Address" autocomplete="off">

        </div>

        <div class="from-group">

            <label for="password">Password</label>
            <input class="form-control" type="password" name="password" id="password" value="<?php echo $arr['password']; ?>" placeholder="Password" autocomplete="off">

        </div>

        <button id="profile-btn-change" type="submit" class="btn">Submit Changes</button>
        <input type="hidden" name="submitted" value="1">

    </form>

这是更新此表单的查询；

                if(isset($_POST['submitted']) == 1){

                $first = mysqli_real_escape_string($dbc, $_POST['first']);
                $last = mysqli_real_escape_string($dbc, $_POST['last']);
                 $password = SHA1($_POST['password']);

                $action = 'Updated';
                $q = "UPDATE users SET first = '".$first."', last = '".$last."', email = '".$_POST['email']."', password = '".$password."' WHERE id = '".$_POST['id']."'";

                $r = mysqli_query($dbc, $q);

                if($r){

                    $message = '<p class="alert alert-success">User Was '.$action.'!</p>';

                        } else {

                    $message = '<p class="alert alert-danger">User Could Not Be '.$action.' Because:'.mysqli_error($dbc);

                        }

            }   

如有任何考虑，我们将不胜感激

Answer 1

您正在 UPDATE 查询中重复 password = 部分。

做

$password = sha1($_POST[password]);

而不是

$password = " password = 'SHA1($_POST[password])', ";

更新

确保尝试更新查询，例如

$q = "UPDATE users SET first = '".$first."', last = '".$last."', email = '".$_POST['email']."', password = '".$password."' WHERE id = '".$_POST['id']."'";

并在使用变量时尝试清理它们。