2012-08-26 72 views
1

我有問題得到正確的sql查詢來更新用戶配置文件。我使用(基本上)相同的查詢來插入數據,它工作正常(只是沒有WHERE id = clientid而沒有clientid在執行數組中。並確保所有的變量都被張貼,他們是作爲一個題外話,就是這個查詢的SQL注入安全嗎?PDO MYSQL更新不起作用

$conn = new PDO("mysql:host=$DB_HOST;dbname=$DB_DATABASE",$DB_USER,$DB_PASSWORD); 

// Deal with the POST variables here...(excluded) 

$sql = "UPDATE clients (firstname, lastname, origincountry, dob, gender, email, phone, address, postal, city, province, referred, notes) 
     VALUES (:firstname, :lastname, :origincountry, :dob, :gender, :email, :phone, :address, :postal, :city, :province, :referred, :notes) 
     WHERE id = :clientid" ; 

$q = $conn->prepare($sql); 

$q->execute(array(':firstname'=>$firstname, 
        ':lastname'=>$lastname, 
        ':origincountry'=>$origincountry, 
        ':dob'=>$dob, 
        ':gender'=>$gender, 
        ':email'=>$email, 
        ':phone'=>$phone, 
        ':address'=>$address, 
        ':postal'=>$postal, 
        ':city'=>$city, 
        ':province'=>$province, 
        ':referred'=>$referred, 
        ':notes'=>$notes, 
        ':clientid'=>$clientid)); 
+0

這是否輸出任何錯誤?嘗試將'error_reporting(E_ALL);'放在代碼的頂部。 –

+0

@ShaquinTrifonoff我補充說,它仍然沒有顯示任何錯誤 – cantaffordretail

+0

它是否與'beginTransaction'和'commit'一起工作? – drjd

回答

3

你的SQL是無效的。參見UPDATE。(感謝@rambocoder指出了這一點)

使用此SQL:

UPDATE clients SET firstname = :firstname, lastname = :lastname, origincountry = :origincountry, dob = :dob, gender = :gender, email = :email, phone = :phone, address = :address, postal = :postal, city = :city, province = :province, referred = :referred, notes = :notes 
WHERE id = :clientid 
+1

你的快速。當我看到它已經在這裏完成時,我只是輸入新的查詢!謝謝! – cantaffordretail

+1

我用了一個正則表達式,這就是爲什麼:-)雖然很快,但很髒。仍然不得不編輯一下。 **查找:**'(。*?),',**替換:**'$ 1 =:$ 1,'。 –

+1

- >感謝您在這裏提到正則表達式。以前從未使用過它們。花了幾個小時來了解正則表達式,但現在我正在通過記事本++中的代碼使用這個新工具:) – cantaffordretail