無法爲用戶更新數據創建安全的方式

Question

我正在爲用戶編輯其數據提供一種方法。我的第一個方法是我工作，但後來我記得它非常不安全，我不應該直接將數據插入到數據庫中;至少這是我被告知的。我嘗試通過執行VALUES（？，？，？，？，？）來使它更安全，以便數據不會直接進入，這似乎在我的註冊頁面中正常工作（如果您想要， ）。

開始，這裏是工作的罰款我原來的更新數據頁，但它不使用方法（，，，，？？？？？）：

if(isset($_POST['submit'])) { 
    $userid=$_SESSION['userid']; 
    $skype=$_POST['skype']; 
    $email=$_POST['email']; 
    $region=$_POST['region']; 
    $crank=$_POST['league1']; 
    $drank=$_POST['league2']; 
     if(empty($skype) || empty($email) || empty($crank) || empty($drank) || empty($region)) 
     { 
      echo "Cannot leave any field blank"; 
     }  
     else 
     { 
      $host= "localhost"; 
      $dbname = "boost"; 
      $user = "root"; 
      $pwd = ""; 
      $port=3306; 

      try 
      { 
       $mysqli= new mysqli($host, $user, $pwd, $dbname,$port); 
       if ($mysqli->connect_error) { 
       die('Connect Error (' . $mysqli->connect_errno . ') ' . $mysqli->connect_error); 
      } 
      $query = "UPDATE usertable SET SkypeID = '$skype', Email = '$email', Region = '$region', CRank = '$crank', DRank = '$drank' WHERE UserID = '$userid'"; 
      $stmt = $mysqli->prepare($query); 
      $stmt->bind_param("sssss",$skype,$email,$region,$crank,$drank); 
      $stmt->execute(); 
      $iLastInsertId=$mysqli->insert_id; 
      header('Location: http://localhost/Boost/account.php'); 
      $stmt->close(); 
      $mysqli->close(); 
     } catch (mysqli_sql_exception $e) { 
     throw $e; 
    } 
    } 
} 

這裏是我試圖做使其更安全，但這似乎並不奏效。具體的$query = "UPDATE usertable SET usertable(SkypeID,Email,Region,CRank,DRank) VALUES (?,?,?,?,?) WHERE UserID = '$userid'";似乎是問題，雖然語法看起來好像沒什麼問題

if(isset($_POST['submit'])) { 
    $userid=$_SESSION['userid']; 
    $skype=$_POST['skype']; 
    $email=$_POST['email']; 
    $region=$_POST['region']; 
    $crank=$_POST['league1']; 
    $drank=$_POST['league2']; 
     if(empty($skype) || empty($email) || empty($crank) || empty($drank) || empty($region)) 
     { 
      echo "Cannot leave any field blank"; 
     }  
     else 
     { 
      $host= "localhost"; 
      $dbname = "boost"; 
      $user = "root"; 
      $pwd = ""; 
      $port=3306; 

      try 
      { 
       $mysqli= new mysqli($host, $user, $pwd, $dbname,$port); 
       if ($mysqli->connect_error) { 
       die('Connect Error (' . $mysqli->connect_errno . ') ' . $mysqli->connect_error); 
      } 
      $query = "UPDATE usertable SET usertable(SkypeID,Email,Region,CRank,DRank) VALUES (?,?,?,?,?) WHERE UserID = '$userid'"; 
      $stmt = $mysqli->prepare($query); 
      $stmt->bind_param("sssss",$skype,$email,$region,$crank,$drank); 
      $stmt->execute(); 
      $iLastInsertId=$mysqli->insert_id; 
      header('Location: http://localhost/Boost/account.php'); 
      $stmt->close(); 
      $mysqli->close(); 
     } catch (mysqli_sql_exception $e) { 
     throw $e; 
    } 
    } 
} 

所以我不知道是什麼問題。在我使用PHP的經驗中，語法應該沒問題，但我必須缺少一些東西。

Answer 1

這是很簡單實際上，你從

$query = "UPDATE usertable SET SkypeID = '$skype', Email = '$email', Region = '$region', CRank = '$crank', DRank = '$drank' WHERE UserID = '$userid'"; 

去

$query = "UPDATE usertable SET usertable(SkypeID,Email,Region,CRank,DRank) VALUES (?,?,?,?,?) WHERE UserID = '$userid'"; 

看來改寫所以解決您只需使用舊的語句時，你感到困惑的INSERT語句與UPDATE語句與新的風格...

$query = "UPDATE usertable SET SkypeID = ?, Email = ?, Region = ?, CRank = ?, DRank = ? WHERE UserID = $userid";