已准备语句未运行MYSQLI PHP
我一直试图切换到准备好的语句,但是我不明白为什么我的新代码不再起作用。我不熟悉使用这些工具,并且还在学习,但我知道这是安全方面的最佳实践。任何帮助都将不胜感激。多谢各位已准备语句未运行MYSQLI PHP,php,mysqli,prepared-statement,Php,Mysqli,Prepared Statement,我一直试图切换到准备好的语句,但是我不明白为什么我的新代码不再起作用。我不熟悉使用这些工具,并且还在学习,但我知道这是安全方面的最佳实践。任何帮助都将不胜感激。多谢各位 <?php $servername = "11.11.11.11"; $username = "root"; $password = "root"; $dbname = "sit"; $conn = new mysqli($servername, $username, $password,$dbname); if (
<?php
$servername = "11.11.11.11";
$username = "root";
$password = "root";
$dbname = "sit";
$conn = new mysqli($servername, $username, $password,$dbname);
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
echo "Connected successfully";
$result = mysqli_query($conn, "SELECT * FROM `ourstory` ");
$values = mysqli_fetch_array($result);
if(isset($_POST['ourstory_title'])){
$ourstory_title = $_POST['ourstory_title'];
$ourstory_testimonial = $_POST['ourstory_testimonial'];
$ourstory_content = $_POST['ourstory_content'];
$ourstory->execute();
$ourstory = $conn->prepare("UPDATE ourstory SET
ourstory_title='$ourstory_title' ,
ourstory_content='$ourstory_content' ,
ourstory_testimonial='$ourstory_testimonial'
WHERE ourstory_id='1'");
$ourstory->bind_param("sss", $ourstory_title, $ourstory_content, $ourstory_testimonial);
if (mysqli_query($conn, $ourstory)) {
echo "Record updated successfully";
} else {
echo "Error updating record: " . mysqli_error($conn);
}
$ourstory->close();
$conn->close();
}
?>
<form id="comment_form" method="post"
action="<?php echo $ourstory?>"
onsubmit="setTimeout(function () {
window.location.reload();
}, 10), location.reload(true);">
<table width="100%" border="0" cellspacing="1" cellpadding="2">
<tr>
<td width="85%">About Us Title</td>
</tr>
<tr>
<td>
<input class="commentarea"
name="ourstory_title" type="text"
id="ourstory_title" value="<?php echo $values['ourstory_title']?>">
</td>
</tr>
<tr>
<td width="85%" >Testimonial</td>
</tr>
<tr>
<td>
<pre>
<textarea class="commentarea"
name="ourstory_testimonial" type="text"
id="ourstory_testimonial" rows= "10" ><?php echo $values['ourstory_testimonial']?>
</textarea>
</pre>
</td>
</tr>
<tr>
<td width="85%" >About Us Content</td>
</tr>
<tr>
<td>
<pre>
<textarea class="commentarea" name="ourstory_content"
type="text" id="ourstory_content"
rows= "10" ><?php echo $values['ourstory_content']?>
</textarea>
</pre>
</td>
</tr>
<tr>
<td>
<input type="submit" value="Update">
</td>
</tr>
</table>
</form>
如果要将值绑定到准备好的语句,则需要在该查询中设置占位符。。。。不注入值本身,然后尝试绑定它们
$ourstory->execute();
printf("Affected rows (UPDATE): %d\n", $ourstory->affected_rows);
您也可以将ourstory\u id
的值与结合在一起,我将以下内容作为补充答案提交,并使用我在OP问题下留下的一些评论
首先,
没有类型type=“text”
删除所有这些
然后,$ourstory->execute()
放错了位置,一旦您使用了Mark的答案并使用了答案和手册中所述的占位符,它就需要在$ourstory->bind_param(“sss”…
后面
您不应该在条件语句中使用if(mysqli_query($conn,$ourstory)){
来检查查询是否确实成功
从您的编辑:
这需要在执行以下操作之后进行:
printf("Affected rows (UPDATE): %d\n", $conn->affected_rows);
但是我会使用一个条件if
来表示,它应该是连接的变量,即手册中的:
<?php
$mysqli = new mysqli("localhost", "my_user", "my_password", "world");
/* check connection */
if (mysqli_connect_errno()) {
printf("Connect failed: %s\n", mysqli_connect_error());
exit();
}
/* Insert rows */
$mysqli->query("CREATE TABLE Language SELECT * from CountryLanguage");
printf("Affected rows (INSERT): %d\n", $mysqli->affected_rows);
我们也要这样做:
手册中的示例:
<?php
$mysqli = new mysqli("localhost", "my_user", "my_password", "world");
/* check connection */
if (mysqli_connect_errno()) {
printf("Connect failed: %s\n", mysqli_connect_error());
exit();
}
/* Insert rows */
$mysqli->query("CREATE TABLE Language SELECT * from CountryLanguage");
printf("Affected rows (INSERT): %d\n", $mysqli->affected_rows);
还有它下面的那个。我想我在评论中涵盖了它的全部或大部分。但是,如果它们碰巧消失了,那么……让我们来看看。
int $mysqli->affected_rows;
printf("Affected rows (UPDATE): %d\n", $conn->affected_rows);
<?php
$mysqli = new mysqli("localhost", "my_user", "my_password", "world");
/* check connection */
if (mysqli_connect_errno()) {
printf("Connect failed: %s\n", mysqli_connect_error());
exit();
}
/* Insert rows */
$mysqli->query("CREATE TABLE Language SELECT * from CountryLanguage");
printf("Affected rows (INSERT): %d\n", $mysqli->affected_rows);