具有多列的PHP MySQL更新集查询_Php_Mysql_Sql_Sql Update

具有多列的PHP MySQL更新集查询

php mysql sql

具有多列的PHP MySQL更新集查询,php,mysql,sql,sql-update,Php,Mysql,Sql,Sql Update,我用逗号和“and”语句尝试了这个查询，如下图所示。我得到一个语法错误出现了问题。您的SQL语法有错误；查看与您的MySQL服务器版本对应的手册，了解可使用的正确语法。near“可通过电话和电子邮件全天候提供，以回答任何问题并为您提供帮助”，第1行每次尝试此查询时： $sql = mysql_query("UPDATE general SET bookabandheading = $_POST[bookabandheading AND bookaband = $_POST[

我用逗号和“and”语句尝试了这个查询，如下图所示。我得到一个语法错误

出现了问题。您的SQL语法有错误；查看与您的MySQL服务器版本对应的手册，了解可使用的正确语法。near

“可通过电话和电子邮件全天候提供，以回答任何问题并为您提供帮助”

，第1行

每次尝试此查询时：

$sql = mysql_query("UPDATE general
    SET bookabandheading = $_POST[bookabandheading 
    AND bookaband = $_POST[bookaband]
    AND contactus = $_POST[contactus]
    AND aboutuslisten = $_POST[aboutuslisten]
    AND contactusheading = $_POST[contactusheading]
    AND nightclubsheading = $_POST[nightclubsheading]
    AND acousticheading = $_POST[acousticheading]
    AND schoolsheading = $_POST[schoolsheading]
    AND privateheading = $_POST[privateheading]
    AND concertsheading = $_POST[concertsheading]
    AND festivalsheading = $_POST[festivalsheading]
    AND submissions = $_POST[submissions]
    AND interns = $_POST[interns]
    AND managementbio = $_POST[managementbio]
    AND latestnews = $_POST[latestnews]
    AND artistofthemonth = $_POST[artistofthemonth]
    AND artistofthemonthphoto = $_POST[artistofthemonthphoto]
    AND artistofthemonthid = $_POST[artistofthemonthid]
    AND listentoourartists = $_POST[listentoourartists]
    AND musicianswanted = $_POST[musicianswanted]
    AND aboutus = $_POST[aboutus]
    AND bshowcases = $_POST[bshowcases]
    AND bandavails = $_POST[bandavails]");

该查询在另一个VPS上的另一个数据库中工作，但我只是迁移了服务器，它不再工作。非常感谢您的帮助

$_POST[bookabandheading

改为

$_POST[bookabandheading]

我认为这有三个问题：

查询中的原始POST数据-至少是用户mysql\u real\u escape\u字符串
参数看起来像字符串，因此应该在其周围加引号
没有WHERE选项，因此您将更新该表中的每一行

语法错误。改变
$\u POST[bookabandheading至$\u POST[bookabandheading]
这也极易发生SQL注入。您应该使用mysqli，但如果您使用的是mysql（从5.5.0开始就不推荐使用），则应该使用mysql\u real\u escape\u string（）对每个$\u POST变量进行转义
每个$\u POST变量都需要使用引号进行参数化。例如：
$\u POST['bookabandheading']（对所有$\u POST变量执行此操作）

$keys = array("bookabandheading", "bookaband", "contactus", "aboutuslisten",
              "contactusheading", "nightclubsheading", "acousticheading",
              "schoolsheading", "privateheading", "concertsheading",
              "festivalsheading", "submissions", "interns", "managementbio",
              "latestnews", "artistofthemonth", "artistofthemonthphoto",
              "artistofthemonthid", "listentoourartists", "musicianswanted",
              "aboutus", "bshowcases", "bandavails");
$set = array();
foreach ($keys as $key) {
    $set[] = sprintf(" %s = '%s' ", $key, mysql_escape_string($_POST[$key]));
}
$sql = mysql_query("UPDATE general SET " . implode(", ", $set));

更新：

$where = array();
$where[] = sprintf(" some_string = '%s' ", mysql_escape_string($some_string));
$where[] = sprintf(" some_integer = %d ", $some_integer);
$where = " WHERE " . implode(" AND ", $where);
$sql = mysql_query("UPDATE general SET " . implode(", ", $set) . " " . $where);

…可全天候提供…