使用 SQL 行值创建 HTML 选择选项并将其用于 SQL 查询

Question

我的网站包含一个用于更新或向 SQL 表添加值的表单。这是表单的代码：

<div>

<?php
if (!isset ($sort))
{
    $sort = 'id';
}
if (isset($_GET["sort"])) 
{
$sort = $_GET["sort"];
}
?>                                  

<h3>Add consignment number:</h3>
<form method='post' action='send.php'>

    <div>Order number:</div>
    <div>
    <?php 
        $sql = mysql_query("SELECT ordernumber FROM sentToCustomer");
        echo "<select name='uselection'>";

        while ($row = mysql_fetch_array($sql)){
            echo "<option value='".$row["ordernumber"]."'>".$row["ordernumber"]."</option>";
        }
        echo "</select>";
    ?>                      
    </div>

    <div>Consignment number:</div>
    <div><input id='vconsignmentnumber' name='uconsignmentnumber' type='text' value='' required></input></div>
    <div><input name='addSent1Form' type='hidden' value='' /></div>
    <div style="clear:both;"/>

    <div></div>
    <div><input  type='submit'  value="Save"></div>     
</form>
</div>

点击保存按钮后，页面 send.php 正在加载：

<?php
include_once("functions.php");

$uconsignmentnumber = $_POST["uconsignmentnumber"];
$uselection = $_POST["uselection"];

SQL_Connect();
$sqlConsignmentNumber = "UPDATE sentToCustomer
        SET consignmentnumber = $uconsignmentnumber
        WHERE ordernumber='$uselection';
        ";
$resultConsignmentNumber = mysql_query($sqlConsignmentNumber);

mysql_close();      
echo "
    <div>
        <fieldset style='margin-top: 40px;'>    
            <legend>Consignmentnumber:</legend>
            <p>
            You just added the Consignment Number ".$consignmentnumber." to the order with the order number ".$uselection.".
            </p>
    </div>
    <div style='float:left;padding-top:3px;'><a href='SentToCustomer.php'<button  value='back'>back</button></a></div>                                      
";
?>      

问题：值 consignmentnumber 未写入数据库。

我认为send.php 页面上的查询可能有问题，因为它应该添加和或更新运单号。 ".$consignmentnumber." 和 ".$uselection." 两个变量都在“您刚刚添加了寄售编号...”-注释中正确打印，但数据库 INSERT/UPDATE 不起作用。有什么建议么？

Answer 1

原文：

$sqlConsignmentNumber = "UPDATE sentToCustomer
        SET consignmentnumber = $uconsignmentnumber
        WHERE ordernumber='$uselection';
    ";

试试这个：

$sqlConsignmentNumber = "UPDATE sentToCustomer
        SET consignmentnumber = '$uconsignmentnumber' WHERE ordernumber = '$uselection'";

在 php.ini 中查找 SQL Prepared Statements。它们将防止您受到 SQL 注入的攻击，并且使您的查询更简单。您基本上编写（准备）您的查询并将其分配给一个变量，然后将您的参数添加到查询中。

例子：

$query = $db->prepare('SELECT id FROM users WHERE username = :username AND password = :password');

$array = array(
    'username' => 'Michael',
    'password' => 'apassword'
);

$query->execute($array);