textarea中的输入将不会在mysql表中更新

我创建了一个表单来更新我网站上的横幅信息。除了输入到名为“desc”的“textarea”中的输入外，一切似乎都会更新。代码看起来不错，它让我疯狂。textarea中的输入将不会在mysql表中更新

在此先感谢。

<html> 
<body> 



<form action="aupdate.php" method="POST" enctype="multipart/form-data"> 

    Your or your company's name:<br> 
    <input type="text" name="com" size="60"><br> 


    URL:<br> 
    <input type="text" name="url" size="80"><br> 


    Please enter the username that you will use to update your advertisement info:<br> 
    <input type="text" name="user" size="80"><br> 

    Please enter the password that you will use to update your advertisement info:<br> 
    <input type="text" name="pass" size="80"><br> 

    <br> 
    <br> 


<br> 
    File:<br> 
    <input type="file" name="image"> 

      advertisement description:<br> 

<textarea name="desc" id="desc" cols="35" rows="5" ></textarea> 

     <input type="submit" value="update your ad!"> 


    </form> 

<?php 

//connect to database 
require("connect.php"); 

//get user made username 
$user = $_POST['user']; 

//get user made password 
$pass = $_POST['pass']; 

//encrypt user made password 
$encpass = hash('sha256', $pass); 

//file properties 
$file = $_FILES['image']['tmp_name']; 

//initialize company name and description 
$com = $_POST['com']; 
$desc = $_POST['desc']; 
$url = $_POST['url']; 




//check to see if coupon code and other essential info entered 
if (!$user || !$pass) 
{ 
    echo "Please enter updated info with username and password."; 
} 
else 
{ 

//retrieve data from password table 
$query = mysql_query ("SELECT * FROM apartment WHERE pass = '$encpass' "); 

//get number of rows in table 
$numrows = mysql_num_rows ($query); 

//check if code is right or exists 
if ($numrows !=0) 
{ 

    // code to login 
    while ($row = mysql_fetch_assoc ($query)) 
    { 
     //retrieve code from database to match with the code that was put into field 
     $dbuser = $row['user']; 
     $dbpass = $row['pass']; 
    } 

    //check to see if they match 
    if ($user == $dbuser && $encpass == $dbpass) 
    { 


    //check to see if a file has even been submitted 
    if (!$file) 
    { 

     echo "please upload image"; 
    } 
    else 
    { 
     //get image file attributes 
    $image = addslashes(file_get_contents ($_FILES['image']['tmp_name'])); 
    $image_name = addslashes($_FILES['image']['name']); 
    $image_size = addslashes(getimagesize($_FILES['image']['tmp_name'])); 

    //check if image file size is right 
    if ($image_size==FALSE) 
     echo "that's not an image."; 
    else 
    { 


mysql_query ("UPDATE apartment SET desc = '$desc' WHERE user ='$user'"); 
mysql_query ("UPDATE apartment SET name = '$image_name' WHERE user ='$user'"); 
mysql_query ("UPDATE apartment SET com = '$com' WHERE user ='$user'"); 
mysql_query ("UPDATE apartment SET url = '$url' WHERE user ='$user'"); 
mysql_query ("UPDATE apartment SET image = '$image' WHERE user ='$user'"); 


      echo "advertisement successfully updated!"; 



    } 
    } 


} 
else 


    echo "Incorrect username or password."; 
} 
else 



    echo "Incorrect username or password."; 

} 

?> 
</body> 
</html>

来源

2011-04-20 user701510

'die（$ desc）'查询前检查。 – 2011-04-20 06:48:08

或'die（mysql_error（））;'在desc查询后检查数据库。请至少在插入数据库之前检查注入的变量，否则会非常危险 – Dormouse 2011-04-20 06:52:11

稍微不相关的一点：可以使用以下命令将您的五个查询合并为一个：mysql_query（“UPDATE apartment SET desc =' $ desc'，name ='$ image_name'，com ='$ com'，url ='$ url'，image ='$ image'WHERE user ='$ user'“）;'。 – Nick 2011-04-20 06:52:27

递减的mysql reserved word括在反引号

和逃避用户输入与mysql_real_escape_string

$desc=mysql_real_escape_string($desc); 
    mysql_query ("UPDATE apartment SET `desc` = '$desc' WHERE user ='$user'");

你也可以提高你的更新查询使用逗号来更新询问分开场1次更新

mysql_query ("UPDATE apartment SET `desc` = '$desc',url='$url' WHERE user ='$user'");

来源

2011-04-20 06:50:43

为什么这是“desc”的情况，而不是正在更新的其他变量？ – user701510 2011-04-20 06:56:28

@user：因为“desc”是mysql保留字，如果你使用保留字作为列名mysql抛出错误信息。如果你把这个保留字反引号，一切都很好。这不仅是“desc”。如果您使用此http://dev.mysql.com/doc/refman/5.1/en/reserved-words.html列表中的任何保留字，则会抛出错误 – 2011-04-20 06:58:42

@user：您还应该使用'mysql_real_escape_string'否则你会遇到另一个问题。如果你把这个文本放在你的textarea中，你会明白我在说什么 – 2011-04-20 07:01:20

textarea中的输入将不会在mysql表中更新

回答

相关问题