<?phpsession_start();include_once 'DBconfig.php';extract($_GET);$CityName = $_POST['CityName'];if (isset($CityID)){ $sql = "UPDATE city SET CityName = '$CityName', Modified = NOW() WHERE city.CityID = $CityID;";}else{ $sql = "INSERT INTO city (CityID, CityName, Created, Modified) VALUES (NULL, '$CityName', NOW(), NOW());";}$result = mysqli_query($con, $sql);if ($result){ header('location: ListCity.php');}else{ header('location: AddEditCity.php');}?>僅執行插入塊更新不起作用 $CityID 變量來自提取函數，因此沒有命名約定問題無法解決它請幫助
1 回答
哈士奇WWW
TA貢獻1799條經驗 獲得超6個贊
您正在從 中提取$_GET（這始終是要避免的），然后$CityName從 中獲取$_POST。這是不一致的，因為請求不能同時是 GET 和 POST。它肯定必須是 POST 請求，否則插入根本無法工作。正如所評論的，您應該使用準備好的語句來避免 SQL 注入攻擊：
<?php
session_start();
include_once 'DBconfig.php';
$CityName = $_REQUEST['CityName'];
if (isset($_REQUEST['CityID']))
{
$CityID = $_REQUEST['CityID'];
$sql = "UPDATE city SET CityName = ?, Modified = NOW() WHERE city.CityID = ?";
$stmt = mysqli_prepare($con, $sql);
mysqli_stmt_bind_param($stmt, "si", $CityName, $CityID);
}
else
{
$sql = "INSERT INTO city (CityID, CityName, Created, Modified) VALUES (NULL, ?, NOW(), NOW())";
$stmt = mysqli_prepare($con, $sql);
mysqli_stmt_bind_param($stmt, "s", $CityName);
}
$result = mysqli_stmt_execute($stmt);
if ($result)
{
header('location: ListCity.php');
}
else
{
header('location: AddEditCity.php');
}
- 1 回答
- 0 關注
- 132 瀏覽
添加回答
舉報
0/150
提交
取消