php - 更新 'pass and confirm' 表单的字段

Question

用户从他的私有(private)区域向我发送更新他自己的级别的请求。级别分为三种类型，从底部依次为“utente”、“delegato”和 super 用户。

事实上，我已经为“utente”级别和“delegato”级别准备了一个页面，通过填写一个简单的表单，他们将名为upgrade_liv的字段从“no”(默认值)更新为“si”。

我构建了一个 php 页面，在其中接收这些请求(我自然是 super 用户)；我用一个数组构建了它，通过我看到所有在upgrade_liv字段中具有值“si”的用户。这是形式:

$query_ver_liv_up="SELECT * from utenti WHERE upgrade_liv = 'si' order by id";
$result_ver_liv_up= mysql_query($query_ver_liv_up); 
$utente_piu = 'delegato';
$delegato_piu = 'superuser';

// tabella upgrade
echo '<table border="1" width="1260px" style="margin-left:auto; margin-right:auto;">';
echo '<tr bgcolor="#bcc500"><td style="border: black 0px solid" height="30px"><b><center>UPGRADE LIVELLO UTENTI</center></b></td></tr>';
echo '</table>';
echo '<table border="1" width="1260px" style="margin-left:auto; margin-right:auto; margin-top:5px;">';
echo '<form method="post" name="ver_liv_upg_yes">';  
echo '<tr bgcolor="#bb6500">';
echo '<td width="100px" style="border: black 1px solid"><center><b>Numero id</center></b></td>';
echo '<td width="300px" style="border: black 1px solid"><center><b>Nome e cognome</b></center></td>';
echo '<td width="120px" style="border: black 1px solid"><center><b>Livello</b></center></td>';
echo '<td width="120px" style="border: black 1px solid"><center><b>Upgrade</b></center></td>';
echo '<td width="180px" style="border: black 1px solid"><center><b>Livello richiesto</b></center></td>';
echo '<td width="120px" style="border: black 1px solid"><center><b>Pass</b></center></td>';
echo '<td width="120px" style="border: black 1px solid"><center><b>Conferma</b></center></td>';
echo '<td width="100px" style="border: black 1px solid"><center><b>Approva</b></center></td>';
echo '<td width="100px" style="border: black 1px solid"><center><b>Nega</b></center></td>';
echo '</tr>';
while($row_ver_liv_up = mysql_fetch_array($result_ver_liv_up))  
{


echo '<tr>';
echo '<td style="border: black 1px solid"><center>'.$row_ver_liv_up['id']."</center></td>";
echo '<td style="border: black 1px solid"><center>'.$row_ver_liv_up['nome']."&nbsp;" .$row_ver_liv_up['cognome']."</center></td>";
echo '<td style="border: black 1px solid"><center>'.$row_ver_liv_up['tipo_user']."</center></td>";
echo '<td style="border: black 1px solid"><center>'.$row_ver_liv_up['upgrade_liv']."</center></td>";
echo '<td style="border: black 1px solid"><center>';
if ($row_ver_liv_up['tipo_user'] == 'utente'){
echo $utente_piu;}
if ($row_ver_liv_up['tipo_user'] == "delegato"){
echo $delegato_piu;}
echo '</center></td>';
echo '<td style="border: black 1px solid"><center>
      <input name="pass" type="password" id="pass" value="" onfocus="if(this.value==\'pass\') this.value=\'\';" /></center></td>';
echo '<td style="border: black 1px solid"><center>
      <input name="conferma" type="password" id="conferma" value="" onfocus="if(this.value==\'conferma\') this.value=\'\';" /></center></td>';
echo '<td style="border: black 1px solid"><center><input style="width: 100px;" name="ver_liv_upg_yes" type="submit" value="Approva" /></center></td>';
echo '<td style="border: black 1px solid"><center><input style="width: 100px;" name="ver_liv_upg_no" type="submit" value="Nega" /></center></td>';
echo '</tr>';
}
echo '</form>';
echo '</table>';

我使用的 php 代码是:

if(isset($_POST['ver_liv_upg_yes'])) 
    {
    $pass = (isset($_POST['pass'])) ? trim($_POST['pass']) : '';  
    $conferma = (isset($_POST['conferma'])) ? trim($_POST['conferma']) : ''; 

    $query =  mysql_query("SELECT * FROM utenti WHERE id = '" . $_SESSION['login'] . "' LIMIT 1");  
    $loggato =  $_SESSION['login'];

    // Controllo la Password
    $pass = $_POST['pass']; 
    if($pass == ""){echo'Campo password non compilato!<br>'; exit();}   
    elseif(strlen($pass) < 4 || strlen($pass) > 12)
        {echo('Password troppo corta o troppo lunga<br>');exit();   }   

    // Controllo la conferma della Password
    $conferma = $_POST['conferma']; 
    if($conferma == ""){echo'Campo conferma password non compilato!<br>'; exit();}      
     elseif(strlen($conferma) < 4 || strlen($conferma) > 12)
        {echo('Conferma della password troppo corta o troppo lunga<br>');exit();    }

    // Controllo se password e conferma sono uguali 
    if($pass != $conferma){echo'I campi password e conferma password devono coincidere!<br>';exit();}       
    $query_pass =  mysql_query("SELECT pass FROM utenti WHERE id = '" . $_SESSION['login'] . "' LIMIT 1");  
    $row_pass = mysql_fetch_array($query_pass);
    $pass2 = $row_pass['pass'];
    $pass = md5($pass);     

    // Crypto la password e la confronto con quella nel database
    if($pass != $row_pass['pass']){echo('Password errata');exit();} 


    $query_ver_liv_up = "SELECT * from utenti WHERE upgrade_liv = 'si' ";
    $result_ver_liv_up = mysql_query($query_ver_liv_up);    
    $row_ver_liv_up = mysql_fetch_array($result_ver_liv_up);
    // Se ha trovato un record
    if(mysql_num_rows($query) == 1) 
    {

    // prelevo l'id dal database
    $login = mysql_fetch_array($query); 


    // preparo la query di aggiornamento
    $query_mod2 = "UPDATE utenti SET upgrade_liv = 'no', tipo_user ='delegato'   WHERE id = '" . $row_ver_liv_up['id']. "'  ";  

    // invio la query
    $result = mysql_query($query_mod2); 
    {header('Location: privata.php'); exit; }
}   
}   

假设我只有两个用户想要更改级别:如果我在第一行插入pass并确认，它会出现echo“Campo密码非编译”(pass not fill)，但是如果我将它们插入第二行，(在我发布的图像中，您可以看到用户第二行的玩具故事)，我的 php 代码在数据库上更改了用户小 pig 佩奇的字段!!!

如何解决这个问题？我的代码哪里错了？

Answer 1

我明白错误在哪里:我已经把

echo '<form method="post" name="ver_liv_up">';

之前

 while($row_ver_liv_up = mysql_fetch_array($result_ver_liv_up)) 
{}

如果我这样写表格:

echo '<table border="1" width="1260px" style="margin-left:auto; margin-right:auto; margin-top:5px;">';
echo '<tr bgcolor="#bb6500">';
echo '<td width="100px" style="border: black 1px solid"><center><b>Numero id</center></b></td>';
echo '<td width="300px" style="border: black 1px solid"><center><b>Nome e cognome</b></center></td>';
echo '<td width="120px" style="border: black 1px solid"><center><b>Livello</b></center></td>';
echo '<td width="120px" style="border: black 1px solid"><center><b>Upgrade</b></center></td>';
echo '<td width="180px" style="border: black 1px solid"><center><b>Livello richiesto</b></center></td>';
echo '<td width="120px" style="border: black 1px solid"><center><b>Pass</b></center></td>';
echo '<td width="120px" style="border: black 1px solid"><center><b>Conferma</b></center></td>';
echo '<td width="100px" style="border: black 1px solid"><center><b>Approva</b></center></td>';
echo '<td width="100px" style="border: black 1px solid"><center><b>Nega</b></center></td>';
echo '</tr>';

 while($row_ver_liv_up = mysql_fetch_array($result_ver_liv_up)) 
{
echo '<form method="post" name="ver_liv_up">';
echo '<tr>';
echo '<td style="border: black 1px solid"><center>'.$row_ver_liv_up['id']."</center></td>";
echo '<td style="border: black 1px solid"><center>'.$row_ver_liv_up['nome']."&nbsp;" .$row_ver_liv_up['cognome']."</center></td>";
echo '<td style="border: black 1px solid"><center>'.$row_ver_liv_up['tipo_user']."</center></td>";
echo '<td style="border: black 1px solid"><center>'.$row_ver_liv_up['upgrade_liv']."</center></td>";
echo '<td style="border: black 1px solid"><center>';
if ($row_ver_liv_up['tipo_user'] == 'utente'){
echo $utente_piu;}
if ($row_ver_liv_up['tipo_user'] == "delegato"){
echo $delegato_piu;}
echo '</center></td>';
echo '<td style="border: black 1px solid"><center>
      <input name="pass" type="password" id="pass" value="" onfocus="if(this.value==\'pass\') this.value=\'\';" /></center></td>';
echo '<td style="border: black 1px solid"><center>
      <input name="conferma" type="password" id="pass" value="" onfocus="if(this.value==\'conferma\') this.value=\'\';" /></center></td>';
echo '<td style="border: black 1px solid"><center><input style="width: 100px;" name="ver_liv_upg_yes" type="submit" value="Approva" /></center></td>';
echo '<td style="border: black 1px solid"><center><input style="width: 100px;" name="ver_liv_upg_no" type="submit" value="Nega" /></center></td>';
echo '</tr>';

echo '</form>';
}
echo '</table>';

开始工作了!!!