【发布时间】:2021-12-21 12:55:51
【问题描述】:
我有一个像这样在我的 php 上声明的变量
$kode = mysqli_real_escape_string($conn, $_POST["kode"]);
$nama = mysqli_real_escape_string($conn, $_POST["nama"]);
$hargabeli = mysqli_real_escape_string($conn, $_POST["hargabeli"]);
$hargajual = mysqli_real_escape_string($conn, $_POST["hargajual"]);
$keterangan = mysqli_real_escape_string($conn, $_POST["keterangan"]);
$brand = mysqli_real_escape_string($conn, $_POST["brand"]);
$kategori = mysqli_real_escape_string($conn, $_POST["kategori"]);
$is_active = mysqli_real_escape_string($conn, $_POST["is_active"]);
$image_name = mysqli_real_escape_string($conn, $fileDestination);
$sumber_pengadaan = mysqli_real_escape_string($conn, $_POST["sumber_pengadaan_id"]);
$supplier = mysqli_real_escape_string($conn, $_POST["supplier_id"]);
$remark = mysqli_real_escape_string($conn, $_POST["remark"]);
$umur_penyusutan_barang = mysqli_real_escape_string($conn, $_POST["umur_penyusutan_barang"]);
$umur_ekonomis = mysqli_real_escape_string($conn, $_POST["umur_ekonomis"]);
$sumber_perolehan = mysqli_real_escape_string($conn, $_POST["sumber_perolehan"]);
$tanggal_invoice = date('Y-m-d', strtotime($_POST['tanggal_invoice']));
对于所有这些结果,我在我的 php 上创建了这个 sql
sql2 = "insert into $tabeldatabase values( '$kode','$nama','$hargabeli','$hargajual','$keterangan','$kategori','','','','','','$brand','','', '$image_name', '', '$sumber_pengadaan','', '$supplier','', '$remark', '$umur_penyusutan_barang', '$umur_ekonomis', '', '$is_active', '$tanggal_invoice', '')";
但问题是,如果$kode存在,程序会自动删除旧数据并替换为新数据,如何根据这种情况设置代码,所以如果kode存在,则不能插入。
我是这么想的,但不知道对不对
sql2 = "insert into $tabeldatabase values( '$kode','$nama','$hargabeli','$hargajual','$keterangan','$kategori','','','','','','$brand','','', '$image_name', '', '$sumber_pengadaan','', '$supplier','', '$remark', '$umur_penyusutan_barang', '$umur_ekonomis', '', '$is_active', '$tanggal_invoice', '') WHERE NOT EXISTS (SELECT * FROM $tabeldatabase WHERE kode = $kode)";
【问题讨论】:
-
警告:您对SQL Injections 持开放态度,应该使用参数化的prepared statements,而不是手动构建查询。它们由PDO 或MySQLi 提供。永远不要相信任何形式的输入!即使您的查询仅由受信任的用户执行,you are still in risk of corrupting your data。 Escaping is not enough!
-
在
$kode应该使用INSERT IGNORE的列上放置一个唯一索引\
标签: php mysql sql-insert