使用HTML表格編輯MySQL重新編碼

Question

我正在學習一個小型PHP項目。我想從MySQL數據庫中檢索保存的數據，並讓用戶使用HTML表單進行編輯。即時檢索數據並顯示在文本框中。問題是當表單提交時數據沒有更新。這裏是我到目前爲止的代碼。文件被自動更新。如果任何人都可以告訴我我哪裏出錯了，那將是最受讚賞的。謝謝。

<?php 

include ("header.php"); 
include ("../db.php"); 

$catname = $_POST['catname']; 
$catdisc = $_POST['catdisc']; 

$id = $_GET['id']; 
     if (isset($id)) 
     { 
$query = "SELECT * FROM categories WHERE catid='$id'"; 
$result= mysql_query($query) or die ('Mysql Error'); 

} 

while($row = mysql_fetch_array($result)){ 
$cname = $row['catname']; 
$cdisc = $row['catdisc']; 
} 

$result= "UPDATE categories SET catname='$catname', catdisc='$catdisc' WHERE catid='$id'" 
or die ('Error Updating'); 

?> 

<h1>Edit Categories</h1> 

<form method="post" action="edit_cat.php?id=<?php echo $id;?>"> 
Category Name: <input type="text" name="catname" value="<?php echo $cname;?>"><br/> 
Category Discription: <TEXTAREA NAME="catdisc"ROWS="3" COLS="25"><?php echo $cdisc;?></TEXTAREA><br/><br/> 
<input type="submit" value="Update Category"/> 
</form> 

<?php 
include ("footer.php"); 
?> 

Answer 1

$result= mysql_query("UPDATE categories SET catname='$catname', catdisc='$catdisc' WHERE catid='$id'") or die ('Error Updating'); 

Answer 2

你是不是在執行UPDATE語句... :)

Answer 3

那麼你在一個字符串定義SQL update命令，但是，呃，你不會提交到數據庫。有一個

$ result = mysql_query（$ query）或die（'Mysql Error'）;

-like row missing。

請記住：（只是另一回事）代碼是非常不安全的 - 因爲它是。

你必須檢查用戶POST輸入數據，發現是方法到您的SQL語句。除非你這樣做，否則每個人都可以擁有完整的數據庫用戶特權訪問權限。 Google：「SQL注入」。

羅布

PS呃是花了5分鐘... ...

Answer 4

一些更改示例代碼，希望這可以幫助你

<?php 
include ("header.php"); 
include ("../db.php"); 

//Getting Data 
$id = (int)$_GET['id']; 
if (isset($id)){ 
    $query = "SELECT `categories`.`catid` AS catid, 
        `categories`.`catname` AS catname, 
        `categories`.`catdisc` AS catdesc 
       FROM categories 
       WHERE catid='".mysql_real_escape_string($id)."' 
       LIMIT 1"; 
    $result= mysql_query($query) or die ('Mysql Error'); 
} 
//Looping through the result, tho we know only 1 result will return 
if(mysql_num_rows($result)>=1){ 
while($row = mysql_fetch_array($result)){ 
    $cat['id'] = $row['catid']; 
    $cat['name'] = $row['catname']; 
    $cat['description'] = $row['catdesc']; 
} 
}else{ 
    $notice = 'No results found matching id:'.htmlentities($id); 
} 

//Updating Content 

//Checking if form has been submitted with some basic checks 
if(
isset($_POST['catid']) && is_numeric($_POST['catid'])==TRUE 
&& isset($_POST['catname']) && $_POST['catname']!="" 
&& isset($_POST['catdesc']) && $_POST['catdesc']!=""){ 


$cat['id'] = (int)$_POST['catid']; 
$cat['name'] = (string)$_POST['catname']; 
$cat['description'] = (string)$_POST['catdesc']; 

//Create the query 
$query="UPDATE categories 
      SET catname='".mysql_real_escape_string($cat['name'])."', catdisc='".mysql_real_escape_string($cat['description'])."' 
      WHERE catid='".mysql_real_escape_string($cat['id'])."'"; 
//Execute the update 
mysql_query($query) or die ('Error Updating'); 
} 
?> 

<h1>Edit Categories</h1> 

<form method="post" action=""> 
<?php echo (isset($notice))?$notice:'';?> 
<input type="hidden" name="catid" value="<?php echo htmlentities($id);?>"> 
Category Name: <input type="text" name="catname" value="<?php echo $cat['name'];?>"><br/> 
Category Discription: <TEXTAREA NAME="catdisc" ROWS="3" COLS="25"><?php echo $cat['description'];?></TEXTAREA><br/><br/> 
<input type="submit" value="Update Category"/> 
</form> 

編輯哎呦我忘了加上ID到表單字段