php mysql查詢多輸入選項的更新行

Question

 <form method="post" action=""> 
     &nbsp; &nbsp;<input id="bfolder" name="movefolder" type="submit" value="Move to folder:"><br><br> 
     </form> 

     $userfile = $user_data['username']; 


     $sql2 = mysql_query("SELECT `id`, `username`, LEFT(`title`, 15) as `title`, LEFT(`description`, 40) as `description`, `folder_name`, `file`, `code`, `type`, `size`, `date` FROM `files` WHERE `username` = '$userfile' AND `folder_name` = '' ORDER BY id DESC $limit"); 


     while ($query_row = mysql_fetch_array($sql2)) { 
      $fileuser = $query_row['username']; 
      $filetitle = $query_row['title']; 
      $filecode = $query_row['code']; 
      $filedesc = $query_row['description']; 
      $filefile = $query_row['file']; 
      $filesize = $query_row['size']; 
      $filedate = $query_row['date']; 
      $filetype = $query_row['type']; 

     if (in_array($filetype, $allowed_image) === true) { 
     if (empty($filetype) === false) { 
      if (strlen($filetitle) < 15) { 
        echo "<div id='imageshowsearch'><span id='linkstylerename'><a href='http://localhost/edu/1111111111111/filerename.php?rename=". $filecode . "'>Edit</a></span><span id='deletefile'><a href='http://localhost/edu/1111111111111/delete_image.php?deletefile=". $filecode . "'>X</a></span><div id='linkstyle'><strong><a href='http://localhost/edu/1111111111111/userdownload.php?code=". $filecode . " '><img src='files/thumbs/" . $filecode . "/" . $filefile . "' alt=" . $filetitle . ">" . $filetitle . "</strong></div></a>"; 
        ?> 
     <select name="folder_option" class="select_folder"> 
     <option>Choose a folder:</option> 
    <?php 
    $mysql_folder = mysql_query("SELECT `folder_name`, `code` FROM `files` WHERE `username` = '$userfile' AND `folder_name` > '' GROUP BY `folder_name` ORDER BY `folder_name` ASC"); 

    while ($query_row = mysql_fetch_array($mysql_folder)) { 
      $filefolder = $query_row['folder_name']; 
      $filecode = $query_row['code']; 
      echo '<option value="' . $filecode . '">' . $filefolder . '</option>'; 
      } 

      if (isset($_POST['movefolder'])) { 
       foreach ($query_row as $key) { 
       mysql_query("UPDATE `files` SET `folder_name` = " . $_POST['folder_name'] . " WHERE `username` = '$userfile' AND `code` = '$filecode'"); 

       //these query not update selected 'folder_name' in database for each file 
       } 
      } 


    ?> 
     </select> 

在一個頁面中，我有10個圖片的名稱和選擇選項創建'folder_name'從MySQL數據庫在while循環。我必須用選定的選項'folder_name'更新mysql數據庫。這些圖片沒有文件夾名稱，但必須具有這些選項才能選擇文件夾並更新數據庫中的數據。

Answer 1

如果您想引用$_POST['folder_name']，您需要將<select name="folder_option" class="select_folder">更改爲<select name="folder_name" class="select_folder">。

更重要的是，你的SQL很容易受到XSS攻擊。在引用SQL中的任何值之前，您絕對需要清理您的$_POST。 mysql_*功能都已被棄用。我建議您立即使用PDO。