不将变量从表单发布到 $self

Question

编辑： 添加了新的代码块

//SCRIPT TO INSERT THE CHANGED ENTRY
    echo "the <b>CONFIRM CHANGES</b> button was pressed<br /><br />";
    $STH = $DBH->("INSERT INTO register (register, location, type, capacity, length, qty, serial, cert, lastinsp, inspby, status, datein, dateout, notes) value (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");

    //bind the parameters to the variables
    $data = array("$register", "$location", "$type", "$capacity", "$qty", "$serial", "$cert", "$lastinsp", "$inspby", "$status", "$datein", "$dateout", "$notes");
    $STH->execute($data);
    echo "Data has been written to the database!<br /><br />";
    echo "<hr />";

我已经屈服于同侪压力并开始使用 PDO 重新编写我的项目（顺便说一句，谢谢，这似乎更容易让我明白！）

我正在通过$_SERVER['PHP_SELF'] 从表单中传递行$id，但没有获取下一个数据库查询的变量。

我希望这是有道理的，受影响的行已被注释，代码如下。

提前致谢。

<?php
//Global Settings
$pagetitle="PDO Test";
$menu="no";
require 'header.php';
require 'dbvars.php';
require 'dafunc.php';

//Page Specific Settigns
$self=htmlentities($_SERVER['PHP_SELF']);

//connect to the database
try {
    $dbh = new PDO("mysql:host=$sqlhost;dbname=$sqldb", $sqluser, $sqlpass);
    /*** echo a message saying we have connected ***/
    echo "Connected to <b>$sqlhost</b> : <b>$sqldb</b><br /><br />";
    $dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    }
catch(PDOException $e)
    {
    echo $e->getMessage();
    }

//if the EDIT button was pressed, do this
if(isset($_POST['edit']))
{   
    $id=$_POST['id'];

    //SCRIPT TO EDIT ENTRY
    echo "the <b>EDIT</b> button was pressed<br /><br />";
    echo "The ID is: $id<br /><br />";

    //this is where I'm trying to use the $id passed from the last form on this page
    $sth = $dbh -> prepare( "select * from register WHERE id=\"$id\"" );

    $sth -> execute();
    $row = $sth -> fetch();

    echo "<form action=\"$self\" method=\"post\">";
    echo "<table width=\"372\" border=\"0\" align=\"center\">";
          echo "<tr><td>ID</td><td>" . $row['id'] . "</td></tr>";
          echo "<input name=\"id\" type=\"hidden\" value=\"" . $row['id'] ."\" />";
          echo "<tr><td>Register</td><td><input name=\"register\" type=\"text\" value=\"". $row['register'] ."\"/></td></tr>";
          echo "<tr><td>Location</td><td><input name=\"location\" type=\"text\" value=\"". $row['location'] ."\"/></td></tr>";
          echo "<tr><td>Type</td><td><input name=\"type\" type=\"text\" value=\"". $row['type'] ."\"/></td></tr>";
          echo "<tr><td>Capacity</td><td><input name=\"capacity\" type=\"text\" value=\"". $row['capacity'] ."\"/></td></tr>";
          echo "<tr><td>Length</td><td><input name=\"length\" type=\"text\" value=\"". $row['length'] ."\"/></td></tr>";
          echo "<tr><td>Qty</td><td><input name=\"qty\" type=\"text\" value=\"". $row['qty'] ."\"/></td></tr>";
          echo "<tr><td>Serial#</td><td><input name=\"serial\" type=\"text\" value=\"". $row['serial'] ."\"/></td></tr>";
          echo "<tr><td>Certificate#</td><td><input name=\"cert\" type=\"text\" value=\"". $row['cert'] ."\"/></td></tr>";
          echo "<tr><td>Last Inspection Completed On</td><td><input name=\"lastinsp\" type=\"text\" value=\"". $row['lastinsp'] ."\"/></td></tr>";
          echo "<tr><td>Last Inspection Completed By</td><td><input name=\"inspby\" type=\"text\" value=\"". $row['inspby'] ."\"/></td></tr>";
          echo "<tr><td>Date introduced into service</td><td><input name=\"datein\" type=\"text\" value=\"". $row['datein'] ."\"/></td></tr>";
          echo "<tr><td>Date removed from service</td><td><input name=\"dateout\" type=\"text\" value=\"". $row['dateout'] ."\"/></td></tr>";
          echo "<tr><td>Notes</td><td><input name=\"notes\" type=\"text\" value=\"". $row['notes'] ."\"/></td></tr>";
    echo "</table>";
    echo "<input type=\"submit\" name=\"confirm_change\" id=\"confirm_change\" value=\"Confirm Changes\" />";
    echo "</form>";
}

//if the confirm_change button was pressed, do this
if(isset($_POST['confirm_change']))
{   
    //fetch form values
    $id = $_POST['id'];
    $register = $_POST['register'];
    $location = $_POST['location'];
    $type = $_POST['type'];
    $capacity = $_POST['capacity'];
    $length = $_POST['length'];
    $qty = $_POST['qty'];
    $serial = $_POST['serial'];
    $cert = $_POST['cert'];
    $lastinsp = $_POST['lastinsp'];
    $inspby = $_POST['inspby'];
    $datein = $_POST['datein'];
    $dateout = $_POST['dateout'];
    $status = $_POST['status'];
    $notes = $_POST['notes'];

    //SCRIPT TO DELETE ENTRY
    echo "the <b>CONFIRM CHANGES</b> button was pressed<br /><br />";
    /*
    $STH = $DBH->("INSERT INTO folks (register, location, type, capacity, length, qty, serial, cert, lastinsp, inspby, status, datein, dateout, notes) value (:register, :location, :type, :capacity, :length, :qty, :serial, :cert, :lastinsp, :inspby, :status, :datein, :dateout, :notes)");

    //bind the parameters to the variables
    $data = array("$register", "$location", "$type", "$capacity", "$qty", "$serial", "$cert", "$lastinsp", "$inspby", "$status", "$datein", "$dateout", "$notes");
    $STH->execute($data);
    echo "Data has been written to the database!<br /><br />";
    */
}

//if the DELETE button was pressed, do this
if(isset($_POST['delete']))
{   
    //SCRIPT TO DELETE ENTRY
    echo "the <b>DELETE</b> button was pressed<br /><br />";
}

//if the edit button wasn't pressed, do this instead
echo "  <form method=\"post\" action=\"$self\">
            <table>
                <tr>
                    <th>ID</th>
                    <th>REGISTER</th>
                    <th>LOCATION</th>
                    <th>TYPE</th>
                    <th>CAPACITY</th>
                    <th>LENGTH</th>
                    <th>QTY</th>
                    <th>SERIAL#</th>
                    <th>CERT#</th>
                    <th>LAST INSPECTION</th>
                    <th>BY</th>
                    <th>DATE IN</th>
                    <th>DATE OUT</th>
                    <th>NOTES</th>
                </tr>";


//get data from the db
$sql = "SELECT * FROM register";
    foreach ($dbh->query($sql) as $row)
        {
          echo "<tr>";
          echo "<td>" . $row['id'] . "</td>";
          echo "<td>" . $row['register'] . "</td>";
          echo "<td>" . $row['location'] . "</td>";
          echo "<td>" . $row['type'] . "</td>";
          echo "<td>" . $row['capacity'] . "</td>";
          echo "<td>" . $row['length'] . "</td>";
          echo "<td>" . $row['qty'] . "</td>";
          echo "<td>" . $row['serial'] . "</td>";
          echo "<td>" . $row['cert'] . "</td>";
          echo "<td>" . $row['lastinsp'] . "</td>";
          echo "<td>" . $row['inspby'] . "</td>";
          echo "<td>" . $row['datein'] . "</td>";
          echo "<td>" . $row['dateout'] . "</td>";
          echo "<td>" . $row['notes'] . "</td>";
          //this is where I'm getting the $id from for the edit script
          echo "<input type=\"hidden\" name=\"id\" id=\"" . $row['id'] . "\">";
          echo "<td><input type=\"submit\" name=\"edit\" id=\"edit\" value=\"Edit\" /></td>";
          echo "<td><input type=\"submit\" name=\"delete\" id=\"delete\" value=\"Delete\" /></td>";
          echo "</tr>";
        }
echo "</table></form>";


?>

Answer 1

我认为您只是错误地使用了execute。首先，您应该：

$sth = $dbh->prepare("INSERT INTO folks (register, location, type, capacity, length, qty, serial, cert, lastinsp, inspby, status, datein, dateout, notes) value (:register, :location, :type, :capacity, :length, :qty, :serial, :cert, :lastinsp, :inspby, :status, :datein, :dateout, :notes)");

然后，当您使用“:register”之类的命名参数时，您需要在执行时提供一个关联数组，例如：

bind the parameters to the variables
$data = array(
    ":register" => $register,
    ":location" => $location,
    //...
    ":notes" => $notes);
$sth->execute($data);

如果你只想传递一个参数值数组，你可以放 ?传递给prepare 的 SQL 字符串中的标记（见下文）。

---

您的第一个查询（在编辑 if 块中）也需要修复。您永远不应该将 POST 数据直接放入您的 SQL 查询中，因为这样做会使您容易受到SQL injection attacks 的攻击。您首先需要“转义” POST 数据中的任何控制字符（例如引号）。 prepare 方法可用于这样做：

$sth = $dbh->prepare("select * from register WHERE id=?");
$sth->execute(array($id));

此处调用execute 时，提供的值数组用于“填充”准备好的语句$sth 中的问号，然后执行该语句。查看PDO::prepare 文档页面上的示例。