php 准备好的语句 ||语法错误或访问冲突 : 1064

Question

下面的代码返回此错误(行号位于括号[]中)

Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ' location, type, capacity, length, qty, serial, cert, lastinsp, inspby, datein, ' at line 1' in D:\Websites\riggingregister\pdo.php:90 Stack trace: #0 D:\Websites\riggingregister\pdo.php(90): PDOStatement->execute(Array) #1 {main} thrown in D:\Websites\riggingregister\pdo.php on line 90

我已在 PHPMyAdmin 中手动编辑了该条目，建议的“PHP 代码”如下:

$sql = "UPDATE `riggingregister`.`register` SET `register` = \'100\',
`location` = \'testing\', `type` = \'Chains - 4 leg\', `capacity` = \'10mm\',
`length` = \'testing\', `qty` = \'testing\', `serial` = \'testing\', 
`cert` = \'testing\', `lastinsp` = \'testing\', `inspby` = \'testing\',
`datein` = \'testing\', `dateout` = \'testing\', 
`status` = \'HOLD\', `notes` = \'EDITED!\' WHERE `register`.`id` = 1;";

但我不确定如何将其转化为我准备好的声明。

我一直在阅读教程、手册以及 SO 提供给我的每个可能的问题，但看不出我哪里出错了。希望有人能指出我正确的方向。

干杯

echo "the <b>CONFIRM CHANGES</b> button was pressed<br /><br />";

    $query = $dbh->prepare('UPDATE register SET register, location, type, capacity, length, qty, serial, cert, lastinsp, inspby, datein, dateout, status, notes VALUES ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ? WHERE id = $id');
    $data = array($register, $location, $type, $capacity, $length, $qty, $serial, $cert, $lastinsp, $inspby, $datein, $dateout, $status, $notes);
    $query->execute($data);

    echo "Data has been written to the database!<br /><br />";

Answer 1

您的 UPDATE 格式错误 您的查询仍然可以通过直接传递 $id 进行注入(inject)。将 $id 添加到 $data 数组的末尾。

尝试

$query = $dbh->prepare('UPDATE register SET register =?, location =?,... WHERE id = ?');
$data = array($register, $location, $type, $capacity, $length, $qty, $serial, $cert, $lastinsp, $inspby, $datein, $dateout, $status, $notes,$id)
$query->execute($data);