這是我第一次使用預準備語句來更新MySQL。不知道我在哪裏出錯,但是當我點擊提交按鈕時,頁面刷新,實際上沒有任何更新生效。PHP準備好的語句不更新SQL數據庫
<?php session_start();
include_once("../includes/connection.php");
include_once("../includes/product.php");
$product = new Product;
$products = $product->fetch_all();
if (isset($_SESSION['logged_in'])) {
if (isset($_GET['id'])) {
$id = $_GET['id'];
$sql_select = "SELECT * FROM products WHERE product_id = '{$id}'";
$statement = $pdo->query($sql_select);
$r = $statement->fetch(PDO::FETCH_ASSOC);
}
if (isset($_POST['submit'])) {
if (isset($_POST['product_name'])) { $name = $_POST['product_name']; }
if (isset($_POST['product_avail'])) { $avail = $_POST['product_avail']; }
if (isset($_POST['product_price'])) { $price = $_POST['product_price']; }
if (isset($_POST['product_desc'])) { $desc = $_POST['product_desc']; }
if (isset($_POST['image'])) { $img = $_POST['image']; }
$sql_update = 'UPDATE products SET (product_name, product_avail, product_price, product_desc, image)
VALUES (:name, :avail, :price, :desc, :img) WHERE product_id = :id';
$updstmt = $pdo->prepare($sql_update);
$updstmt->execute(array(
':id' => $id,
':name' => $name,
':avail' => $avail,
':price' => $price,
':desc' => $desc,
':img' => $img));
}
?>
<?php include_once("../includes/header.php"); ?>
<h4>Edit product</h4>
<!-- call error if any required fields are empty -->
<?php if (isset($error)) { ?>
<small style="color:#aa0000;">* <?php echo $error; ?>
<?php } ?>
<form action="edit_test.php?id=<?php echo $_GET['id']; ?>" method="post">
<small>Product Name</small><br />
<input type="text" name="product_name" value="<?php echo $r['product_name']; ?>" <?php if (isset($error) && empty($_POST['product_name'])) { ?> class="error" <?php } ?>/>
<br /><br />
<small>Available?</small>
<input type="text" name="product_avail" value="<?php echo $r['product_avail']; ?>" <?php if (isset($error) && empty($_POST['product_avail'])) { ?> class="error" <?php } ?>/>
<small>Price</small>
$<input type="number" min="0.01" step="0.01" name="product_price" value="<?php echo $r['product_price']; ?>" <?php if (isset($error) && empty($_POST['product_price'])) { ?> class="error" <?php } ?>/>
<br /><br />
<small>Product Description</small>
<textarea rows="20" cols="30" name="product_desc" <?php if (isset($error) && empty($_POST['product_desc'])) { ?> class="error" <?php } ?>><?php echo $r['product_desc']; ?> </textarea><br /><br />
<br /><br />
<small>Product Image</small>
<input type="text" name="image" value="<?php echo $r['image']; ?>" <?php if (isset($error) && empty($_POST['i'])) { ?> class="error" <?php } ?>/>
<input type="submit" value="POST" class="submit save">
</form>
<br /><br />
<small><a href="index.php">← Back</a></small>
</div>
<?php include("../includes/footer.php"); ?>
<?php
}
?>
我哪裏錯了?
你很容易受到[sql注入攻擊](http://bobby-tables.com)的影響。爲什麼在其他查詢中使用準備好的語句,而不是**第一個從產品查詢中選擇的語句? – 2014-11-05 20:25:42
UPDATE沒有VALUES,它有SET;本週第二次。 – 2014-11-05 20:27:12
如果沒有更新,那麼插入''UPDATE products SET'到'INSERT INTO products'很難說你想在這裏做什麼。 – 2014-11-05 20:32:50