不接收使用模具（mysql_error）

Question

整個MySQL錯誤消息我試着這樣做：

<?php 
    if(isset($_POST['update']) && isset($_GET['topic_id'])) 
    { 
     $title=$_POST['title']; 
     $tag_h1=$_POST['tag_h1']; 
     $tag_h2=$_POST['tag_h2']; 
     $tag_metadata=$_POST['tag_metadata']; 
     $content=$_POST['content']; 
     $topic_id=$_GET['topic_id']; 


    mysql_query(" 
    UPDATE topic 
    SET tag_h1=$tag_h1,tag_h2=$tag_h2,tag_metadata=$tag_metadata,content=$content,title=$title 
    WHERE topic_id=$topic_id 
    ") or die(mysql_error); 

    echo "$title<br/>"; 
    echo "$tag_h1<br/>"; 
    echo "$tag_h2<br/>"; 
    echo "$tag_metadata<br/>"; 
    echo "$content<br/>"; 
    } 

?> 

但我鉻得到錯誤100，並出現沒有在Firefox

Answer 1

您的查詢失敗，因爲沒有輸入的值由引號：

mysql_query(" 
UPDATE topic 
/* Enclose all variables in single quotes (unless they are integer values) */ 
SET tag_h1='$tag_h1',tag_h2='$tag_h2',tag_metadata='$tag_metadata',content='$content',title='$title' 
WHERE topic_id='$topic_id' 
") or die(mysql_error()); 
//-------------------^^^^ 
//() needed here. 

注1：mysql_error()是一個必須與()調用的函數。這就是爲什麼你看不到打印錯誤的原因。

注2，此腳本廣泛開放給SQL注入攻擊。過濾所有$_POST值與mysql_real_escape_string()

$title = mysql_real_escape_string($_POST['title']); 
    $tag_h1 = mysql_real_escape_string($_POST['tag_h1']); 
    $tag_h2 = mysql_real_escape_string($_POST['tag_h2']); 
    $tag_metadata = mysql_real_escape_string($_POST['tag_metadata']); 
    $content = mysql_real_escape_string($_POST['content']); 
    $topic_id = mysql_real_escape_string($_GET['topic_id']);