用PHP更新MySQL

Question

我想用输入表单更新MySQL数据库,本质上是一个用户可以更新/更改其信息的设置页面.使用下面的代码,底部的echo运行,我没有收到任何错误,但数据库没有更新.我在我的本地计算机和服务器上测试了它,但它也没有用,但我不确定它与它有什么关系.$_SESSION['yourName']用户登录时已设置,因此它将等于数据库中的当前值.我知道这里有很多sql注入漏洞,但这只是一个概念验证代码,还没有准备好上线.我尝试在phpMyAdmin中运行查询,它运行正常.

PHP

if(isset($_POST['name']) || isset($_POST['password']) || isset($_POST['location']) || isset($_POST['img'])) {
 //put this in an external file for a little extra security
 $username = "my_username";
 $password = "my_password";
 $database = "database_name";
 $con = mysql_connect('localhost',$username,$password);
 if (!$con) {
    die('Oh poop.... Could not connect: ' . mysql_error());
 }
 //print item from database
 mysql_select_db($database, $con);

 if(isset($_POST['name'])) {
    $query = 'UPDATE users SET username=' . $_POST['name'] . 'WHERE username=' . $_SESSION['yourName'];
    mysql_query($query);
    $_SESSION['yourName'] = $_POST['name'];
 }
 if(isset($_POST['password'])) {
    $query = 'UPDATE users SET password=' . $_POST['password'] . 'WHERE username=' . $_SESSION['yourName'];
    mysql_query($query);
 }
 if(isset($_POST['location'])) {
    $query = 'UPDATE users SET location=' . $_POST['location'] . 'WHERE username=' . $_SESSION['yourName'];
    mysql_query($query);
    $_SESSION['location'] = $_POST['location'];
 }
 if(isset($_POST['img'])) {
    $query = 'UPDATE users SET img=' . $_POST['img'] . 'WHERE username=' . $_SESSION['yourName'];
    mysql_query($query);
    $_SESSION['img'] = $_POST['img'];
 }
 echo '<script type="text/javascript">alert("changes saved")</script>';
}

HTML

<form method="post">
    new name: <input type="text" name="name" /><br />
    new password: <input type="text" name="password" /><br />
    new location: <input type="text" name="location" /><br />
    new img: <input type="text" name="img" /><br />
    <input type='submit' name='save' value='save' />
    <input type='submit' name='logout' value='logout' />
</form>

Answer 1

尝试使用双引号而不是单引号修改您的php语句.

$query = "UPDATE users SET username='" . $_POST['name'] . "' WHERE username= '" . $_SESSION['yourName'] . "'";

但上面的查询容易受到影响SQL Injection,请阅读下面的文章,

• 如何在PHP中防止SQL注入？