【发布时间】:2015-05-11 14:42:50
【问题描述】:
代码:
$new_deb = 5;
//prepare query();
$q = 'START TRANSACTION;';
for($l = 0; $l < $cond; $l++){
if($uploaded == 0 || $uploaded == "0"){
$q .= ' INSERT INTO vocher (`vo_type_id`, `account_id`, `value`, `desc`, `user_id`, `status_id`, `date`, `debtor_id`)';
$q .= ' VALUES ("'.$vouchertype.'", "'.$voucheracc[$l].'","'.$vdebvalue[$l].'", "'.$vdebdesc[$l].'","'.$_POST['usrSes'].'", "'.$status.'","'.$vocherdate[$l].'", "'.$new_deb.'");';
}else{
$q .= ' INSERT INTO vocher (`vo_type_id`, `account_id`, `value`, `desc`, `user_id`, `status_id`, `date`, `debtor_id`, `link`)';
$q .= ' VALUES ("'.$vouchertype.'", "'.$voucheracc[$l].'","'.$vdebvalue[$l].'", "'.$vdebdesc[$l].'","'.$_POST['usrSes'].'", "'.$status.'","'.$vocherdate[$l].'", "'.$new_deb.'", "'.$newAttach.'");';
}
$q .= ' SET @lastId = (SELECT `id` FROM vocher ORDER BY `id` DESC LIMIT 1);';
if($voCc[$l] != 'e'){
for($h = 0; $h < count($voCc[$l]); $h++){
if($voCc[$l][$h] != 'e'){
$q .= ' INSERT INTO voucher_cc (`voucher`, `cc`) VALUES (@lastId, "'.$voCc[$l][$h].'");';
}
}
}
if(in_array($voucheracc[$l], $inResetAccs)){
$q .= ' INSERT INTO resets ( `type`, `acc`, `user`, `value`, `desc`, `debtor_id`, `date`, `status`)';
$q .= ' VALUES ("IN", "'.$voucheracc[$l].'", "'.$_POST['usrSes'].'", "'.$vdebvalue[$l].'", "'.$vdebdesc[$l].'", "'.$new_deb.'", "'.$vocherdate[$l].'", "1");';
}
}
for($z = 0; $z < $chqradiolength; $z++){
if ($chqradio[$z] == "0") {
$q .= ' INSERT INTO creditor (`acc_id`, `value`, `bank_id`, `debtor_id`, `cheque_no`, `issue_date`, `available_date`, `vo_type_id`, `desc`, `date`, `user`)';
$q .= ' VALUES ("'.$chequeAcc[$z].'", "'.$vvalue[$z].'", "'.$banks[$z].'", "'.$new_deb.'", "'.$vsn[$z].'", "'.$issuesdates[$z].'", "'.$availabledate[$z].'", "'.$vouchertype.'", "'.$vdesc[$z].'", "'.$credates[$z].'", "'.$_POST['usrSes'].'");';
$q .= ' SET @creLastId = (SELECT `id` FROM creditor ORDER BY `id` DESC LIMIT 1);';
for($x = 0; $x < count($chequeCc[$z]); $x++){
$q .= ' INSERT INTO creditor_cc (`creditor`, `cc`) VALUES (@creLastId, "'.$chequeCc[$z][$x].'");';
}
}else{
$q .= ' INSERT INTO creditor (`acc_id`, `value`, `debtor_id`, `date`, `desc`, `vo_type_id`, `user`)';
$q .= ' VALUES ("'.$creaccs[$z].'", "'.$vvalue[$z].'", "'.$new_deb.'" , "'.$credates[$z].'" , "'.$vdesc[$z].'" , "'.$vouchertype.'", "'.$_POST['usrSes'].'");';
$q .= ' SET @creLastId = (SELECT `id` FROM creditor ORDER BY `id` DESC LIMIT 1);';
if($creCc[$z] != 'e'){
for($x = 0; $x < count($creCc[$z]); $x++){
if($creCc[$z][$x] != 'e'){
$q .= ' INSERT INTO creditor_cc (`creditor`, `cc`) VALUES (@creLastId, "'.$creCc[$z][$x].'");';
}
}
}
if(in_array($creaccs[$z], $outResetAccs)){
$q .= ' INSERT INTO resets (`type`, `acc`, `user`, `value`, `desc`, `debtor_id`, `date`, `status`)';
$q .= ' VALUES ("OUT", "'.$creaccs[$z].'" , "'.$_POST['usrSes'].'" , "'.$vvalue[$z].'", "'.$vdesc[$z].'" , "'.$new_deb.'", "'.$credates[$z].'", "1");';
}
}
}
$q .= ' COMMIT;';
$vocher_obj->query($q);
$check = $vocher_obj->execute();
if($check){
$res = 1;
}else{
$res = 23;
}
echo $res;
此代码用于生成一些查询。
即使我将表名更改为数据库中的“不存在”表,这些查询也总是返回“true”,而它应该返回“false”!
你能帮我解决这个问题吗?
【问题讨论】:
-
您不应该将多个查询语句填充到单个查询调用中。而且您的代码本质上是活泼的。您不应该使用
select ...来获取最后生成的ID。有insert_id()。不能保证其他人不会在你背后插入记录。 -
这就是为什么我要创建一个事务,所以在事务完成之前没有其他人可以插入。而且我使用的是 PDO 而不是 MYSQLI
-
确保您的事务设置实际上在重复读取模式下工作,然后...
-
您正在使用 PDO,但您的 SQL 对注入开放...
-
@MarcB,我怎么能确定呢?