<?phpsession_start();include_once 'DBconfig.php';extract($_GET);$CityName = $_POST['CityName'];if (isset($CityID)){ $sql = "UPDATE city SET CityName = '$CityName', Modified = NOW() WHERE city.CityID = $CityID;";}else{ $sql = "INSERT INTO city (CityID, CityName, Created, Modified) VALUES (NULL, '$CityName', NOW(), NOW());";}$result = mysqli_query($con, $sql);if ($result){ header('location: ListCity.php');}else{ header('location: AddEditCity.php');}?>僅執(zhí)行插入塊更新不起作用 $CityID 變量來自提取函數(shù)，因此沒有命名約定問題無法解決它請(qǐng)幫助
1 回答
哈士奇WWW
TA貢獻(xiàn)1799條經(jīng)驗(yàn) 獲得超6個(gè)贊
您正在從 中提取$_GET（這始終是要避免的），然后$CityName從 中獲取$_POST。這是不一致的，因?yàn)檎?qǐng)求不能同時(shí)是 GET 和 POST。它肯定必須是 POST 請(qǐng)求，否則插入根本無法工作。正如所評(píng)論的，您應(yīng)該使用準(zhǔn)備好的語句來避免 SQL 注入攻擊：
<?php
session_start();
include_once 'DBconfig.php';
$CityName = $_REQUEST['CityName'];
if (isset($_REQUEST['CityID']))
{
$CityID = $_REQUEST['CityID'];
$sql = "UPDATE city SET CityName = ?, Modified = NOW() WHERE city.CityID = ?";
$stmt = mysqli_prepare($con, $sql);
mysqli_stmt_bind_param($stmt, "si", $CityName, $CityID);
}
else
{
$sql = "INSERT INTO city (CityID, CityName, Created, Modified) VALUES (NULL, ?, NOW(), NOW())";
$stmt = mysqli_prepare($con, $sql);
mysqli_stmt_bind_param($stmt, "s", $CityName);
}
$result = mysqli_stmt_execute($stmt);
if ($result)
{
header('location: ListCity.php');
}
else
{
header('location: AddEditCity.php');
}
- 1 回答
- 0 關(guān)注
- 167 瀏覽
添加回答
舉報(bào)
0/150
提交
取消