如何遍历我的数组并将其保存到数据库（PHP）？答案

【问题标题】：How do I loop through my array and save it to database (PHP)?如何遍历我的数组并将其保存到数据库（PHP）？
【发布时间】：2022-11-14 11:55:23
【问题描述】：

我有一个从数据库中选择的表，希望用户只更新其中的一列。我使用在每行末尾添加的用户输入框将行回显到表中。我尝试了 foreach 循环并最终出现错误“致命错误：未捕获错误：类 mysqli_result 的对象无法转换为字符串...”当我打印用户输入的数组时，它会显示，但我是努力在准备好的陈述中使用它。

<?php
 if (isset($_POST['save'])){
  

if(!empty($_POST['newbid'])) {
    $biduserID = $_SESSION['id'];
    $itemID = $_GET['ItemId'];
    $bidprice = ($_POST['newbid']);
$getcurrentround = "SELECT `Round` FROM `RoundCounter` WHERE `ItemID` =".$_GET['ItemId']."";
$currentroundresult= $db->query($getcurrentround);
$currentround = $currentroundresult->fetch_assoc();
$currentround1 = $currentround['Round'];
$biddername = $_SESSION["id"];
$count = $_POST['count'];
$newbid = $_POST['newbid']; // check empty and check if interger
print_r($newbid);
$getusername = "SELECT `Username` FROM `User` WHERE `UserID` = `$biddername`";
$username1= $db->query($getusername);
$getbandname = "SELECT `BandName` FROM `BidTables` WHERE `ItemID` =" .$_GET['ItemId']."";
$bandname= $db->query($getbandname);
$getnumberlots = "SELECT numberlots FROM `Item` WHERE `ItemID` =".$_GET['ItemId']."";
    $numberlots= $db->query($getnumberlots);

$bid = 1;
   
    foreach($_POST as $bid => $value) {


    

    $sql4 = "INSERT INTO BidTables (`BandName`,`BidderID`, `ItemID`, `BidPrice`, `Round`, `Username`) VALUES
    (?,?,?,?,?,?)";
    $stmt = $db->prepare($sql4);
    echo $db->error;
    
        $stmt->bind_param("siiiis", $bandname, $biduserID, $itemID, $bid ,$currentround1, $username1 );
$stmt->execute();
}
}
?>

这是带有表格数据的提交按钮：

<form action="" method="POST">
        <table class="table table-hover">
                <thead class="thead">
                <tr class="header">
                    
                    
                <th>ID</th>
                    <th>Band</th>
            <th>Current Price</th>
               
                </tr>
                <?php 
                $sql = "SELECT * FROM BidTables WHERE ItemID = ".$_GET['ItemId']." ORDER BY `Round` DESC";
                $resultSQL= mysqli_query($db, $sql);
                   
                   if(mysqli_num_rows($resultSQL) > 0){
                   
                    }
                   
                   ?>
                </thead>
                <tbody>
                <!-- PHP CODE TO FETCH DATA FROM ROWS -->
                
                <tr>
               
    <?php
    // LOOP TILL END OF DATA
    while($row = $resultSQL->fetch_assoc()) { 
   ?>
      <tr>
        <td><?=$row['bidtable']?></td> 
        <td><?=$row['BandName']?></td>
        <td><?=$row['BidPrice']?></td>
        <td><input type="number" name="newbid[]" size="10" /></td> 
      </tr>
    <?php } ?>
 </table>
 <input type="hidden" name="count" value="<?=$resultSQL->num_rows?>" /> 
 <button class="btn btn-primary btn-lg" name="save">Submit</button>
</form>

我感谢任何帮助/指针

编辑1：我为每个 SELECT 使用了准备好的语句，并且我的 INSERT 函数中的每个语句都出现错误：“警告：数组到字符串的转换...”

这是准备好的语句的代码：

<?php

 if (isset($_POST['save'])){
  

if(!empty($_POST['newbid'])) {
    $biduserID = $_SESSION['id'];
    $itemID = $_GET['ItemId'];
    $bidprice = ($_POST['newbid']);
    
$count = $_POST['count'];
$newbid = $_POST['newbid']; // check empty and check if interger
print_r($newbid);


$sql6 = "SELECT `Round` FROM `RoundCounter` WHERE `ItemID` =?"; // SQL with parameters
$stmt6 = $db->prepare($sql6); 
$stmt6->bind_param("i", $itemID);
$stmt6->execute();
$result6 = $stmt6->get_result(); // get the mysqli result
$round = $result6->fetch_assoc(); // fetch data   



$sql7 = "SELECT `Username` FROM `User` WHERE `UserID` = ?"; // SQL with parameters
$stmt7 = $db->prepare($sql7); 
$stmt7->bind_param("i", $biduserID);
$stmt7->execute();
$result7 = $stmt7->get_result(); // get the mysqli result
$username = $result7->fetch_assoc(); // fetch data   



$sql8 = "SELECT `BandName` FROM `BidTables` WHERE `ItemID` =?"; // SQL with parameters
$stmt8 = $db->prepare($sql8); 
$stmt8->bind_param("i", $itemID);
$stmt8->execute();
$result8 = $stmt8->get_result(); // get the mysqli result
$bandname = $result8->fetch_assoc(); // fetch data   




    $sql9 = "SELECT numberlots FROM `Item` WHERE `ItemID` =?"; // SQL with parameters
$stmt9 = $db->prepare($sql9); 
$stmt9->bind_param("i", $itemID);
$stmt9->execute();
$result9 = $stmt9->get_result(); // get the mysqli result
$numberlots = $result9->fetch_assoc(); // fetch data 

   
    foreach($_POST as $bid => $value) {
      
    $sql4 = "INSERT INTO BidTables (`BandName`,`BidderID`, `ItemID`, `BidPrice`, `Round`, `Username`) VALUES
    (?,?,?,?,?,?)";
    $stmt = $db->prepare($sql4);
    echo $db->error;
    
        $stmt->bind_param("siiiis", $bandname, $biduserID, $itemID, $bid ,$round, $username );
$stmt->execute();
}       
}
 }
?>

【问题讨论】：

mysqli_query 返回 mysqli_result，而不是单个值。您需要使用给定的 mysqli_result 方法从结果中获取值。
您应该使用准备好的语句全部您的查询，而不仅仅是 INSERT 的
警告：您对SQL Injections 持开放态度，应该使用参数化准备好的陈述而不是手动构建查询。它们由PDO 或MySQLi 提供。永远不要相信任何形式的输入！即使您的查询仅由受信任的用户执行，you are still in risk of corrupting your data。 Escaping is not enough!
我已编辑以包含准备好的语句，但仍然出现错误：数组到字符串的转换
你有数组，所以你需要在每个循环中插入该数组的 1 个值

标签： php mysql

【解决方案1】：

有人好心地帮我找到了问题，我错误地准备了我的桌子。最终循环如下所示：

foreach ($newBidIds as $id){
    $insertStmt = $db->prepare("INSERT INTO BidTables (`BandName`,`BidderID`, `ItemID`, `BidPrice`, `Round`, `Username`) VALUES (?,?,?,?,?,?) ;");
    $insertStmt->bind_param("siiiis", $bandname1, $bidUserID, $itemID, $id,$round1, $username);
    $insertStmt->execute();
}

【讨论】：