用户尚未更新的表单更新字段 - PHP Query

Question

我的 PHP 查询需要一些帮助。我实际上是让用户有机会在他们登录后更新他们自己的详细信息。表单：

<div class="grid-2"> 
    <p><b>UPDATE MY DETAILS</b></p>
        <form action ="includes/update.inc.php" method ="post">
        <label>S.Name</label>
        <input name="update-surname" type="text" placeholder="Enter new surname...">
        <label>Address</label>
        <input name="update-houseno" type="text" placeholder="Enter house no' or name...">
        <input name="update-ln1" type="text" placeholder="1st Line of Address...">
        <input name="update-town" type="text" placeholder="Town...">
        <input name="update-county" type="text" placeholder="County...">
        <input name="update-postcode" type="text" placeholder="Postcode...">
        <label>Contact Number</label>
        <input name="update-number" type="text" placeholder="Contact Number...">
        <label>Email</label>
        <input name="update-email" type="text" placeholder="Email...">

        <input type="submit" name="update-details" value="Update">
    </form>
</div>

我目前拥有的 php 代码，如果用户没有在框中输入任何内容，它会使用空白输入更新数据库（我不希望发生这种情况），如果没有输入我不想要触摸表格中的那个字段。

    <?php
// Here we check whether the user got to this page by clicking the proper button.
if (isset($_POST['update-details'])) {

      require 'dbh.inc.php';

// We grab all the data which we passed from the signup form so we can use it later.
    $surname = $_POST['update-surname'];
    $houseno = $_POST['update-houseno'];
    $ln1 = $_POST['update-ln1'];
    $town = $_POST['update-town'];
    $county = $_POST['update-county'];
    $postcode = $_POST['update-postcode'];
    $email = $_POST['update-email'];
    $number = $_POST['update-number'];

      // We validate the updated email is correct if email has been updated. 
  if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    header("Location: ../after-login.php?error=invalidmail=");
    exit();
    }

    $query = "UPDATE `tblMember` SET `fldSName` = '$surname', `fldTelNum` = '$number', `fld1stLnAddress` = '$houseno', `fld2ndLnAddress` = '$ln1', `fld3rdLnAddress` = '$town', `fldCounty` = '$county', `fldPostcode` = '$postcode', `fldEmailAddress` = '$email' WHERE `tblMember`.`fldMemberID` = 1";


    $result = $conn->query($query) or die ("error");
}
?>

一旦加载了 php 表单，网页就会消失，并且不会停留在当前网页上。

所以需要两件事，帮助正确查询和帮助页面变为空白而不停留在网页上。

请注意，我知道这很容易受到注入攻击，我只是想让它在物理上正常工作，然后再尝试了解我如何做准备好的语句。

谢谢！

Answer 1

您需要检查数据输入字段是否为非空/有效。

避免空白字段更新的步骤：

1) 取一个空数组

2) 检查每个发布的变量是否有效，如果有效则将其附加到数组中。

3) 检查数组是否为空。

4) 如果不为空，则触发 SQL。

<?php
// Here we check whether the user got to this page by clicking the proper button.
if (isset($_POST['update-details'])) {

      require 'dbh.inc.php';

// We grab all the data which we passed from the signup form so we can use it later.
    $ln1 = $_POST['update-surname'];
    $houseno = $_POST['update-houseno'];
    $ln1 = $_POST['update-ln1'];
    $town = $_POST['update-town'];
    $county = $_POST['update-county'];
    $postcode = $_POST['update-postcode'];
    $email = $_POST['update-email'];
    $number = $_POST['update-number'];

      // We validate the updated email is correct if email has been updated. 
  if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    header("Location: ../after-login.php?error=invalidmail=");
    exit();
    }

    $update = [];
    if (! empty($surname)) {
        $update['fldSName'] = "fldSName = '".$surname ."'";
    }

    if (! empty($number)) {
        $update['fldTelNum'] = "fldTelNum='".$number ."'";
    }

    if (! empty($houseno)) {
        $update['fld1stLnAddress'] = "fld1stLnAddress='".$houseno ."'";
    }

    if (! empty($ln1)) {
        $update['fld2ndLnAddress'] = "fld2ndLnAddress='".$ln1 ."'";
    }

    if (! empty($town)) {
        $update['fld3rdLnAddress'] = "fld3rdLnAddress='".$town ."'";
    }

    if (! empty($county)) {
        $update['fldCounty'] = "fldCounty='".$county ."'";
    }
    if (! empty($postcode)) {
        $update['fldPostcode'] = "fldPostcode='".$postcode ."'";
    }
    if (! empty($email)) {
        $update['fldEmailAddress'] = "fldEmailAddress='".$email ."'";
    }


    if (! empty($update)) {
        $query = "UPDATE `tblMember` SET ";
        $query .= implode(', ', $update);
        $query .= " WHERE `tblMember`.`fldMemberID` = 1";
        $result = $conn->query($query) or die ("error");
    }
}
?>

注意：

fldMemberID 似乎是硬编码的。

Answer 2

<?php
// Here we check whether the user got to this page by clicking the proper button.
if (isset($_POST['update-details'])) {

    require 'dbh.inc.php';

// We grab all the data which we passed from the signup form so we can use it later.
    $surname = $_POST['update-surname'];
    $houseno = $_POST['update-houseno'];
    $ln1 = $_POST['update-ln1'];
    $town = $_POST['update-town'];
    $county = $_POST['update-county'];
    $postcode = $_POST['update-postcode'];
    $email = $_POST['update-email'];
    $number = $_POST['update-number'];

    // We validate the updated email is correct if email has been updated.
    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        header("Location: ../after-login.php?error=invalidmail=");
        exit();
    }

    $query = "UPDATE `tblMember` SET ";
    (!empty($surname))?: $query .= "`fldSName` = '$surname',";
    (!empty($houseno))?: $query .= "`fldTelNum` = '$houseno',";
    (!empty($ln1))?: $query .= "`fld1stLnAddress` = '$ln1',";
    (!empty($town))?: $query .= "`fld2ndLnAddress` = '$town',";
    (!empty($county))?: $query .= "`fld3rdLnAddress` = '$county',";
    (!empty($postcode))?: $query .= "`fldCounty` = '$postcode',";
    (!empty($email))?: $query .= "`fldPostcode` = '$email',";
    (!empty($number))?: $query .= "`fldEmailAddress` = '$number'";



   $query .= " WHERE `tblMember`.`fldMemberID` = 1";


    $result = $conn->query($query);

    header("Location: ../after-login.php");  //make sure of the path

}

基本上你是在检查你的输入值，就像你通过连接查询块来构建你的查询一样。

最后添加标题以将您重定向到所需的页面。

Answer 3

对于第一个问题，您可以将查询编辑为

UPDATE tblMember
SET fldSName = IF('$surname' = '', fldSName, '$surname'),
    fldTelNum = IF('$number' = '', fldTelNum, '$number'),
    fld1stLnAddress = IF('$houseno' = '', fld1stLnAddress, '$houseno'),
    fld2ndLnAddress = IF('$ln1' = '', fld2ndLnAddress, '$ln1'),
    fld3rdLnAddress = IF('$town' = '', fld3rdLnAddress, '$town'),
    fldCounty = IF('$county' = '', fldCounty, '$county'),
    fldPostcode = IF('$postcode' = '', fldPostcode, '$postcode'),
    fldEmailAddress = IF('$email' = '', fldEmailAddress, '$email'),
WHERE  
    `tblMember`.`fldMemberID` = 1  

对于第二个问题，您必须删除 die() 并重定向到 after-login.php as

 $conn->query($query);
 header("Location: ../after-login.php");