MySQL查詢正在運行但未運行

Question

好吧讓我在這裏解釋一下自己：

我正在製作一個基於在線文本的遊戲。我有一個頁面，3件事情都可能發生：

他們可以創建一個位置

可以編輯的位置

可以刪除的位置

到目前爲止，我已經創造了崗位工作。我接着刪除了一個職位。一切都很好，我沒有錯誤，沒有警告等。當我跑了它，它回到了它應該在腳本刪除位置後的屏幕上跑。只有在查詢運行後纔會來到這裏。

好吧，什麼都沒有發生，經過3個小時的嘗試廢話後，我來到你們的B/C我在我的最後一站。我仍然沒有嚴重錯誤，沒有任何事情使它失敗：這是我的代碼。

<?php 
//In the include file is the connection to the db 
include("library/new_library.php"); 

//Below is the session id, gets their position id from the DB, than grabs whether or not they can edit the company 
$user_id = $_SESSION['user_id']; 
$sql = "SELECT ID, PositionID FROM users WHERE ID = '$user_id'"; 
$query = mysql_query($sql); 
while($row = mysql_fetch_assoc($query)) 
{ 
    $position = $row['PositionID']; 
} 
$sql = "SELECT * FROM tblCPositions WHERE PositionID = '$position'"; 
$query = mysql_query($sql); 
while($row = mysql_fetch_assoc($query)) 
{ 
    $editCompany = $row['Edit_Company']; 
} 


//Next I check for position edit and if they try to put in the position id of a position the company does not control it gives them a "nice" message. 
$company = $_SESSION['company']; 
if($_GET['pidedit']){ 
    $position = $_GET['pidedit']; 
    $sql = "SELECT * FROM tblCPositions WHERE PositionID = '$position'"; 
    $query = mysql_query($sql); 
    while($row = mysql_fetch_assoc($query)) 
    { 
     if($row['CompanyID'] != $company) 
     { 
      $warning = "<div class='warning'>You are trying to edit a position that does not belong to your company. DO NOT TRY TO CHEAT THE SYSTEM!</div>"; 
     } 
     else 
     { 
      $positionArray[] = array(ID => $row['PositionID'], name => $row['Name'], hire => $row['Hire'], fire => $row['Fire'], bid => $row['Contract'], edit => $row['Edit_Company'], finances => $row['Finances']); 
     } 
    } 
} 

//Here I check for $_GET delete 
elseif($_GET['piddelete']) 
{ 
    $position = $_GET['piddelete']; 
    $sql = "SELECT * FROM tblCPositions WHERE PositionID = '$position'"; 
    $query = mysql_query($sql); 
    while($row = mysql_fetch_assoc($query)) 
    { 
     if($row['CompanyID'] != $company) 
     { 
      $warning = "<div class='warning'>You are trying to delete a position that does not belong to your company. DO NOT TRY TO CHEAT THE SYSTEM!</div>"; 
     } 
    } 
} 
else 
{ 
    $sql = "SELECT * FROM tblCPositions WHERE CompanyID = '$company'"; 
    $query = mysql_query($sql); 
    $number = mysql_num_rows($query); 
    $numberLeft = 12 - $number; 
    while($row = mysql_fetch_assoc($query)) 
    { 
     $positionArray[] = array(ID => $row['PositionID'], name => $row['Name'], hire => $row['Hire'], fire => $row['Fire'], bid => $row['Contract'], edit => $row['Edit_Company'], finances => $row['Finances']); 
    } 
} 

// 
if($_POST['submitNewPosition']) 
{ 
    $name = $_POST['positionName']; 
    $hire = $_POST['hire']; 
    $fire = $_POST['fire']; 
    $bid = $_POST['bid']; 
    $edit = $_POST['edit']; 
    $finances = $_POST['finances']; 
    $cid = $_SESSION['company']; 
    $sql = "INSERT INTO tblCPositions(CompanyID, Name, Hire, Fire, Contract, Edit_Company, Finances) VALUES ('$cid','$name','$hire','$fire','$bid','$edit','$finances')"; 
    $query = mysql_query($sql); 
    if($query) 
    { 
     header("location: view_company.php?newp=success"); 
    } 
} 

//Haven't finished this section yet 
if($_POST['submitEditPosition']) 
{ 
    $name = $_POST['positionName']; 
    $fire = $_POST['hire']; 
    $fire = $_POST['fire']; 
    $bid = $_POST['bid']; 
    $edit = $_POST['edit']; 
    $finances = $_POST['finances']; 
} 

//This this is my problem area, this is where it says its running the query but its not. 
if(isset($_POST['deletePosition'])) 
{ 
    $deleteID = $_GET['piddelete']; 
    $deleteSql = "DELETE FROM tblCPositions WHERE PositionID = '$deleteID'"; 
    $deleteQuery = mysql_query($deleteSql); 
    if($deleteQuery) 
    { 
     header("location: view_company.php?delete=success"); 
    } 
    if(!$deleteQuery) 
    { 
     header("location: view_company.php?delete=failure"); 
    } 
} 

UPDATE -

好了，所以我得到它的工作的問題是什麼我忘了，這種形式只是意味着是一個「是或否的形式」，所以我在做後期才交提交按鈕，窗體上沒有其他東西。我忘記了action =「file.php」（我有）忘記傳遞get變量，所以一旦我改變它的行動=「file.php？piddelete = 12」它的工作。

感謝大家的幫助，我真的很感激它。

Answer 1

10對1您的變量$_GET['piddelete'];爲空。當你這樣做時，你會得到什麼：

var_dump($_GET['piddelete']); 

禁用標題重定向，以便您可以看到輸出。

編輯

或者，正如尼克指出的那樣，你可以添加die()陳述你的查詢：

$deleteQuery = mysql_query($deleteSql) or die(mysql_error()); 

如果查詢仍在運行，在腳本不會死，和位置爲仍然未刪除，則應檢查查詢，可能會成功刪除0行。嘗試在die($deleteSql);處查殺並通過MySQL的控制檯運行查詢。

/編輯

此外，我不得不給你介紹我的好朋友SQL injection attack。在將它們交給MySQL服務器之前，您應該過濾所有包含在$_POST和$_GET超全局星線中的數據。使用mysql_real_escape_string()。

嘗試神交此：

whatever.com/your_url.php?pidedit=x'%3B%20DROP%20TABLE%20tblCPositions%3B%20-- 

如果我執行你的應用程序，查詢字符串，你tblCPositions表將被丟棄。