2017-05-06 87 views
0

我有一个点击最喜欢的明星,我想检查数据库,如果记录存在它将删除记录,如果它不存在它将插入记录,什么是问题未插入记录删除记录,如果它存在,否则插入

 <?php 
    include "config.php"; 
    header('Content-Type: application/json'); 
    $landmarkid = $_GET['landmarkid']; 
    $userid = $_GET['userid']; 


    try { 
     $query = mysqli_query($con,"SELECT * from favourite WHERE userid =$userid AND L_ID = $landmarkid"); 



     if(mysqli_num_rows($query) > 0) 
     { 
      $q1 = mysqli_query($con,"DELETE from favourite WHERE userid =$userid AND L_ID = $landmarkid"); 

      if($q1){ 
       echo '{"Deleted":"true"}'; 
      } 
      else { 
       echo '{"Deleted":"false"}'; 
      } 
     } 
     else { 
      $q2 = mysqli_query($con,"INSERT INTO favourite (userid,L_ID) VALUES ($userid, $landmarkid) "); 

      if($q2){ 
       echo '{"inserted":"true"}'; 
      } 
      else { 
       echo '{"inserted":"false"}'; 
      } 
     } 

     } catch (Exception $e) { 
     echo 'Caught exception: ', $e->getMessage(), "\n"; 
    } 
?> 
+0

真的吗?让__sure__明白'mysqli_query'和'mysql_query'之间的区别,然后再来。 –

+0

@u_mulder抱歉,现在呢? –

+0

现在你必须明白这一行是什么意思'$ query =($ con,“SELECT * from favorite where userid ='$ userid'AND L_ID ='$ landmarkid'”);' –

回答

0

尝试向您的插入语句中添加单引号,看看它是否有效。改变这种说法;

$q2 = mysqli_query($con,"INSERT INTO favourite (userid,L_ID) VALUES ($userid, $landmarkid) "); 

对此;

$q2 = mysqli_query($con,"INSERT INTO favourite (userid,L_ID) VALUES ('$userid', '$landmarkid') "); 

让我知道是否有帮助,或者如果您发现问题。

+0

没有任何内容插入 –

+0

你不需要引用标记时,整合整数值。我假设的* id * s是整数。 – Martin

0

我已在下面重写您的代码。

几点:

  • 你的代码是vulerable SQL注入这样假设ID是一个数值我强迫输入瓦尔($userid$landmarkid)是使用(int)铸造整数。

  • 你的第一个检查查询可以返回一个值COUNT,它比返回*更好,那么你可以为你的if语句,$result['numb']检查特定值。

  • 我已经在SQL中正确地转义了您的php变量,但您确实应该尝试使用为此编写的语句

  • 我不认为你需要的try{} catch {}这里作为当前的代码不会抛出异常(据我所知)

  • 添加LIMIT您delete语句使你永远不能删除比多预定的行数。这充当故障安全,因此您不会无意删除整个表格。


<?php 
include "config.php"; 
header('Content-Type: application/json'); 
$landmarkid = (int)$_GET['landmarkid']; 
$userid = (int)$_GET['userid']; 

try { 
    $query = mysqli_query($con,"SELECT COUNT(*) as numb FROM 
      favourite WHERE userid = ".$userid." AND 
      L_ID = ".$landmarkid); 
    $result = mysqli_fetch_aray($query); 

    if($result['numb'] > 0) 
    { 
     $q1 = mysqli_query($con,"DELETE FROM favourite 
       WHERE userid = ".$userid." AND L_ID = ".$landmarkid." 
       LIMIT 1"); 
     print "deleted"; 
    } 
    else { 
     $q2 = mysqli_query($con,"INSERT INTO favourite (userid,L_ID) 
       VALUES (".$userid", ".$landmarkid.") "); 
     print "inserted"; 
    } 
    } 
    catch (Exception $e) { 
     echo 'Caught exception: ', $e->getMessage(), "\n"; 
    } 
    ?> 

相关问题