需要php mysql更新语句教程的帮助吗
我试图学习一个教程，但在下面的可执行php文件第二段代码的第六行出现了一个数据库错误需要php mysql更新语句教程的帮助吗,php,mysql,sql-update,Php,Mysql,Sql Update,我试图学习一个教程，但在下面的可执行php文件第二段代码的第六行出现了一个数据库错误 <?php mysql_connect("localhost","root","") or die("Error: ".mysql_error()); //add your DB username and password mysql_select_db("beyondmotors");//add your dbname
<?php
mysql_connect("localhost","root","") or die("Error: ".mysql_error()); //add your DB username and password
mysql_select_db("beyondmotors");//add your dbname
$sql = "select * from `TestTable` where ID = 1";
$query = mysql_query($sql);
while ($row = mysql_fetch_array($query)){
$id = $row['ID'];
$fname = $row['FName'];
$lname = $row['LName'];
$phone = $row['PHON'];
//we will echo these into the proper fields
}
mysql_free_result($query);
?>
<html>
<head>
<title>Edit User Info</title>
</head>
<body>
<form action="updateinfo.php" method="post">
userid:<br/>
<input type="text" value="<?php echo $id;?>" name="id" disabled/>
<br/>
Last Name:<br/>
<input type="text" value="<?php echo $fname;?>" name="fname"/>
<br/>
Last Name:<br/>
<input type="text" value="<?php echo $lname;?>" name="lname"/>
<br/>
Phone Number:<br/>
<input type="text" value="<?php echo $phone;?>" name="phon"/>
</br>
<input type="submit" value="submit changes"/>
</form>
</body>
</html>
<?php
mysql_connect("localhost","root","") or die("Error: ".mysql_error()); //add your DB username and password
mysql_se lect_db("beyondmotors");//add your dbname
//get the variables we transmitted from the form
$id = $_POST[''];
$fname = $_POST['fname'];
$lname = $_POST['lname'];
$phon = $_POST['phon'];
//replace TestTable with the name of your table
$sql = "UPDATE `TestTable` SET `FName` = '$fname',`LName` = '$lname',
`PHON` = '$phon' WHERE `TestTable`.`ID` = '$id' LIMIT 1";
mysql_query($sql) or die ("Error: ".mysql_error());
echo "Database updated. <a href='editinfo.php'>Return to edit info</a>";
?>
UPDATE TestTable SET FName = '$fname',LName = '$lname',PHON ='$phon'
WHERE TestTable.ID = '$id' LIMIT 1";
首先，也最重要的是，应该警告您的代码完全容易受到攻击。在将POST数据插入数据库之前发布数据是保护数据库的良好开端 此外，学习新系统是无用的，因为它已被弃用。您可以考虑查看接口或扩展。两者都有很多好处，你会收获更多 现在，至于你的错误 确保您正在定义要在数据库中更新的ID。在第二段代码中，您有：
//get the variables we transmitted from the form
$id = $_POST[''];
$id = $_POST['id'];
//replace TestTable with the name of your table
$sql = "UPDATE TestTable SET FName = '$fname',LName = '$lname',
PHON = '$phon' WHERE ID = '$id' LIMIT 1";
当然，这是一种易受sql注入攻击的攻击。您数据库的用户实际上是根用户，没有密码吗？如果不是，您需要在脚本的开头插入实际用户名和密码作为mysql\u connect的第二个和第三个参数。它被称为脚本，而不是可执行文件。您设置$id=$\u POST[]有什么原因吗？引号之间的位应该是您希望它从中获取ID的字段的名称，就像您在表单中有对应于fname字段的“fname”一样，依此类推。@所做的只是抑制错误消息，它不会神奇地修复它们。如果您遇到T_字符串错误，您的引号可能已关闭。粘贴您用于$sql=的确切代码。此外，您不必每次回复评论时都更新原始帖子。您也可以通过单击“添加注释”来使用注释。如果可能重复，请不要忘记将过滤器和转义添加到您的值中。我知道是你建议的，但这不在你的计划之内code@Baba更好的是，我刚刚添加了使用mysqli和PDO的示例：]
/* connect to the database */
$mysqli = new mysqli("localhost", "user", "password", "database");
if ($mysqli->connect_errno) {
echo "Failed to connect to MySQL: (" . $mysqli->connect_errno . ") " . $mysqli->connect_error;
}
/* build prepared statement */
$stmt = $mysqli->prepare("UPDATE TestTable SET FName=?, LName=?, PHON=? WHERE ID=?)");
/* bind your parameters */
$stmt->bind_param('sssi', $fname, $lname, $phon, $id);
/* execute prepared statement */
$stmt->execute();
/* close connection */
$stmt->close();
/* connect to the database */
$dbh = new PDO('mysql:host=localhost;dbname=database', $user, $pass);
/* build prepared statement */
$stmt = $dbh->prepare("UPDATE TestTable SET FName = :fname, LName = :lname, PHON = :phon WHERE ID = :id");
/* bind your parameters */
$stmt->bindParam(':fname', $fname);
$stmt->bindParam(':lname', $lname);
$stmt->bindParam(':phon', $phon);
$stmt->bindParam(':id', $id);
/* update one row */
$fname = 'John'; # or use your $_POST data
$lname = 'Doe';
$phon = '123-456-7890';
$id = 1;
/* execute prepared statement */
$stmt->execute();
/* use it again!1! */
$fname = 'Jane';
$lname = 'Doe';
$phon = '123-456-7890';
$id = 2;
/* execute prepared statement */
$stmt->execute();
/* close connection */
$dbh = null;