2012-09-28 70 views
2

我一直在將我的網站從不受保護的mysql查詢改寫爲mysqli預準備語句,並且一切進行得很順利,直到得到此結果爲準備語句中的參數沒有提供數據。沒有提供準備好的語句中的參數的數據MySQLi PHP

我已經研究過它無濟於事,我正在請求這個社區的盲目迷人來幫助我。

if(empty($err)) { 
    $pSETQuery = NULL; 
    if(!empty($_POST['password'])) { 
     $pSETQuery .= ", password = ?"; 
    } 
    if($session->isSuperuser()) { 
     $pSETQuery .= ", usertype = ?"; 
    } 
    if(!($stmt = $database->prepare("UPDATE user SET username = ?, email = ? $pSETQuery WHERE UserId = ?"))) { 
     $err[] = "PREPARE FAILED."; 
    } 
    $stmt->bind_param("s", $_POST['username']); 
    $stmt->bind_param("s", $_POST['email']); 
    if(!empty($_POST['password'])) { 
     $stmt->bind_param("s", $_POST['password']); 
    } 
    if($session->isSuperuser()) { 
     $stmt->bind_param("s", $_POST['usertype']); 
    } 
    $stmt->bind_param("i", $_POST['userid']); 
    if(!$stmt->execute()){ 
     $err[] = "Execute failed. ERROR: " . $stmt->error; 
    } 

} 

問候, 哈利

+0

任何幫助,將不勝感激,需要一個快速的答案,將接受它,如果它是值得的。 – PwnageAtPwn

回答

0

好像您可能想要在繼續​​前更新其配置文件之前驗證所有這些字段。

if(empty($err)) { 

    //Check for UserId, otherwise you can't update a profile 
    if (empty($_POST['userid'])) { 
     //Handle error here... 
     exit; 
    } 

    $userid = $_POST['userid']; 

    //Filter out all NULL values and replace with empty strings (safety first!) 
    $username = empty($_POST['username']) ? '' : $_POST['username']; 
    $password = empty($_POST['password']) ? '' : $_POST['password']; 
    $email = empty($_POST['email']) ? '' : $_POST['email']; 
    $usertype = empty($_POST['usertype']) ? '' : $_POST['usertype']; 

    $pSETQuery = ''; 
    $pSETQuery .= !empty($username) ? ", username = ?" : ""; 
    $pSETQuery .= !empty($password) ? ", password = ?" : ""; 
    $pSETQuery .= (!empty($usertype) && $session->isSuperuser()) ? ", usertype = ?" : ""; 
    //This line stops someone from being able to enter a blank username 

    //Prepare statement 
    if(!($stmt = $database->prepare("UPDATE user SET email = ? $pSETQuery WHERE UserId = ?"))) { 
     $err[] = "PREPARE FAILED."; 
    } 

    //Bind parameters where appropriate 
    $stmt->bind_param("s", $email); 
    if(!empty($username)) $stmt->bind_param("s", $username); 
    if(!empty($password)) $stmt->bind_param("s", $password); 
    if($session->isSuperuser() && !empty($usertype)) $stmt->bind_param("s", $usertype); 
    $stmt->bind_param("i", $userid); 

    //Execute statement 
    if(!$stmt->execute()){ 
     $err[] = "Execute failed. ERROR: " . $stmt->error; 
    } 
} 
0

「沒有在事先準備好的聲明參數提供的數據」意味着語句是好的,但你要提供的bind_param瓦爾的至少一個是預期不存在!我會打印出$ _POST,看看發生了什麼,最終設置$ pSETQuery ='';而不是空!

$_POST['username'] 
$_POST['email'] 
$_POST['password'] 
$_POST['usertype'] 
$_POST['userid'] // this one is the one i would really watch after, how do you tell the userid if the user is not logged (i assume that from email, passwrod and might be wrong) 

歡呼

2

你使用Zend框架? 這可能是Php和Zend之間的版本問題。 我得到了PHP 5.3 +的問題,他們在插入Zend Framework 1.8.3時出現同樣的錯誤。

如果您在這種情況下,其中一種解決方案是將連接器更改爲數據庫。試試這個,它爲我工作:

$db = new Zend_Db_Adapter_Pdo_Mysql(array(
    'host'  => '127.0.0.1', 
    'username' => 'webuser', 
    'password' => 'xxxxxxxx', 
    'dbname' => 'test' 
)); 
0

我找到解決同樣的問題的方式。

這是一個值過去的MySQL,它是NULL。鑑於此列不能在表格定義中爲NULL ...

相關問題