我正在尝试创建一个用户可以更新其个人资料详细信息的表单,但它似乎无法正常工作.
我是服务器端编程的初学者,所以我正在拼凑不同教程的代码.来自http://www.codingcage.com/2015/04/php-login-and-registration-script-with.html
该class.user.php文件,最初只有进行登录,并注册代码.我复制了注册函数并更改了一些内容而不是更新:
public function update($id,$uname,$umob,$uaddr,$uacc,$upass) {
try {
$upass = password_hash($upass, PASSWORD_DEFAULT);
$stmt = $this->conn->prepare(
"UPDATE users
SET
id = :id,
name = :uname,
mobile = :umob,
address = :uaddr,
accNo = :uacc,
password = :upass
WHERE id = :id"
);
$stmt->bindParam(":id", $id);
$stmt->bindParam(":upass", $upass);
$stmt->bindParam(":uacc", $uacc);
$stmt->bindParam(":uname", $uname);
$stmt->bindParam(":uaddr", $uaddr);
$stmt->bindParam(":umob", $umob);
$stmt->execute();
return $stmt;
}
catch(PDOException $e) {
echo $e->getMessage();
}
}
并在view_account.php中 :(编辑3,整个文件包括@e_i_pi的代码更正):
<?php
ini_set("error_log", "/path/to/error.log");
require_once("session.php");
require_once("class.user.php");
$auth_user = new USER();
$stmt = $auth_user->runQuery("SELECT * FROM users WHERE consumer-no=:cno");
$userRow = $stmt->fetch(PDO::FETCH_ASSOC);
if(!$session->is_loggedin()){
// session no set redirects to login page
$session->redirect('index.php');
}
if(isset($_POST['submit']) && $_POST['submit'] === 'save') {
$uname = strip_tags($_POST['full-name']);
$umob = strip_tags($_POST['mobile']);
$uaddr = strip_tags($_POST['addr']);
$uacc = strip_tags($_POST['bank-acc']);
$id = strip_tags($_POST['id']);
$upass = strip_tags($_POST['password']);
if($uname=="") {
$signuperror[] = "Please Enter Your Full Name!";
}
else if($umob=="") {
$signuperror[] = "Please Enter Your Mobile No.!";
}
else if($uaddr=="") {
$signuperror[] = 'Please Enter Your Address!';
}
else if($upass=="") {
$signuperror[] = "Please Enter a Password!";
}
else if(strlen($upass) < 6) {
$signuperror[] = "Password must be atleast 6 characters";
}
else {
try {
// I commented out these for some weird reason I can't even rememebr
// $stmt = $auth_user->runQuery("SELECT id FROM users WHERE id=:id");
// $stmt->execute(array(':id'=>$id));
// $row = $stmt->fetch(PDO::FETCH_ASSOC);
$auth_user->update($id,$uname,$umob,$uaddr,$uacc,$upass);
}
catch(PDOException $e) {
echo $e->getMessage();
}
}
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Gas Booking</title>
<link rel="stylesheet" href="style.css">
</head>
<body>
<header>
<h1>gas booking</h1>
<nav>
<ul>
<li><a href="index.php">home</a></li>
<li><a href="booking.php">booking</a></li>
<li><a href="payment.php">payment</a></li>
<li><a href="ticket.php">ticket</a></li>
<li><a href="view_account.php">view account</a></li>
<li><a href="user-bank.php">bank</a></li>
<li><a href="logout.php?logout=true">logout</a></li>
</ul>
</nav>
</header>
<div class="content">
<h2>Edit Your Profile Details</h2>
<form method="post" action="view_account.php">
<input type="hidden" id="id" name="id" value="<?php echo $_SESSION['id']; ?>">
<label for="full-name" class="input-info">
<div class="label">full name</div>
<input type="text" id="full-name" name="full-name" value="<?php echo $_SESSION['name']; ?>">
</label>
<label for="mobile" class="input-info">
<div class="label">mobile number</div>
<input type="text" id="mobile" name="mobile" value="<?php echo $_SESSION['mob']; ?>">
</label>
<label for="addr" class="input-info">
<div class="label">address</div>
<input id="addr" name="addr" value="<?php echo $_SESSION['addr']; ?>">
</label>
<label for="bank-acc" class="input-info">
<div class="label">bank account number</div>
<input type="text" id="bank-acc" name="bank-acc" value="<?php echo $_SESSION['accNo']; ?>">
</label>
<hr>
<label for="password" class="input-info">
<div class="label">password</div>
<input type="password" id="password" name="password">
</label>
<button type="submit" name="submit" value="save">
Save Changes
</button>
</form>
</div>
</body>
</html>
我的表格如下:
--
-- Table structure for table `users`
--
CREATE TABLE IF NOT EXISTS `users` (
`id` int(11) NOT NULL AUTO_INCREMENT,
`consumerNo` varchar(15) NOT NULL,
`password` varchar(255) NOT NULL,
`accNo` varchar(255) NOT NULL,
`name` varchar(255) NOT NULL,
`address` varchar(255) NOT NULL,
`mobile` bigint(10) NOT NULL,
`balance` bigint(10) NOT NULL,
`joining_date` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
PRIMARY KEY (`id`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1 AUTO_INCREMENT=1 ;
我敢肯定我做了些蠢事.我真的很感激我指向正确的方向,我一直坐到凌晨5点,我对自己感到沮丧.
与db的连接正常,类正确包含在内.如果您需要更多信息,请与我们联系.谢谢!
该项目可以在这里下载:https://www.dropbox.com/s/9v69m18l82n1t46/gas.zip?dl=0.警告代码有点混乱.
您似乎在执行以下操作view-account.php:
try {
$auth_user->update($id,$uname,$umob,$uaddr,$uacc,$upass);
} catch(PDOException $e) {
echo $e->getMessage();
}
但是你已经try/catch在你的update()方法中了.我认为它从来没有达到这一点,因为你的if/elseif/elseif/else/etc支票中的错误被选中.你可以修改它看起来像测试目的:
$errors = [];
if ($uname == "") {
$errors[] = "Please Enter Your Full Name!";
}
if ($umob == "") {
$errors[] = "Please Enter Your Mobile No.!";
}
if ($uaddr == "") {
$errors[] = 'Please Enter Your Address!';
}
if ($upass == "") {
$errors[] = "Please Enter a Password!";
}
if (strlen($upass) < 6) {
$errors[] = "Password must be atleast 6 characters";
}
// check errors
if (!empty($errors)) {
print_r($errors);
return false;
}
// otherwise try the query:
$obj = $auth_user->update($id, $uname, $umob, $uaddr, $uacc, $upass);
让我们知道会发生什么!
我假设你有一个错误抛出的东西;
SQLSTATE [HY093]:参数号无效
这是因为你试图绑定:id两次.你必须记住用户ID是唯一的,不应该改变(对吗？).
修改您的查询,如下所示:
$stmt = $this->conn->prepare(
"UPDATE users
SET
name = :uname,
mobile = :umob,
address = :uaddr,
accNo = :uacc,
password = :upass
WHERE id = :id"
);
if(PASSWORD == PASSWORD_REPEAT) { .... SET PASSWORD...)ID在表单中传递用户.这是不安全的.既然它$_SESSION已经存在,只需在您的view-account.php文件中访问它!
<form...元素,我可以很容易地将隐藏的输入修改为其他用户ID,允许我更改他们的密码/信息/等.action属性...因此它什么都不做..最好将其更改为您的view-account.php页面strip_tags().它可能会毁掉一些字段(即密码).你也已经绑定/准备你的陈述(道具就是你,干得好!)view-account.php文件,可以对其进行修改以停止使用所有这些if / elseif / elseif / else语句.你实际上是在检查你的所有字段,如果它失败了,你就会向一个数组添加一条错误消息,但是如果它通过你正在运行查询,这是不好的做法.你应该看一下类似于(伪代码)的东西:$errors = [];
if (!check_fields()) {
$errors[] = THE FIELD ERROR MESSAGE;
}
// now check if your errors are empty or not
if(!empty($errors)) {
// this means we have errors in the form.
// return the errors array to the front end and handle it appropriately.
return $errors;
}
// otherwise we can try the query here now!
try {
// YOUR SQL UPDATE QUERY
} .....`