0

我写了以下代码，但它没有更新数据库，它是脚本的一部分并且它停止工作..找不到解决方法..需要建议

<?php
$link = mysql_connect('xxxxxxxx');
if (!$link) {
die('Could not connect: ' . mysql_error());
}

mysql_select_db("xxx", $link);


$usernames='aneeshxx';
echo $usernames;

$update = "INSERT sanjana SET $name ='$usernames'";
mysql_query($update, $link);

$update1 = "INSERT INTO sanjana (name)VALUES ($usernames)";
mysql_query($update1, $link);


?>
4

4 回答 4

3 
$update = "INSERT sanjana SET $name ='$usernames'";

this probably is meant as an UPDATE statement, so for an update it should be

$update = "UPDATE sanjana set name = '$usernames'";

I put name and not $name due to your second query and not seeing $name being defined anywhere. Be aware that this will change the value in the column name of every row in the sanjana table to the value of $usernames, normally a statement such as this gets limited by conditions, e.g. WHERE userid = 33

$update1 = "INSERT INTO sanjana (name) VALUES ($usernames)";

for an INSERT statement it needs to have the values quoted so

$update1 = "INSERT INTO sanjana (name) VALUES ('$usernames')";

Be wary that this way of putting variables directly into your query string makes you vulnerable to SQL injection, to combat this please use the PDO or mysqli extensions, they both protect you from injection by providing you with prepared statements ; plain old mysql_* is not recommended for use anymore.

using pdo you'd use prepared statements like this

<?php
// we got $usernames from wherever you define it

$pdo = new PDO('mysql:dbname=mydb;host=localhost','username','password');

// to insert
$statement = $pdo->prepare('INSERT INTO `sanjana` (name) VALUES (:name)');
// the following replaces :name with $usernames in a safe manner, defeating sql injection
$statement->bindParam(':name',$usernames);
$statement->execute(); // it is done


// to update
$statement = $pdo->prepare('UPDATE `sanjan` SET `name` = :name');
$statement->bindParam(':name',$usernames);
$statement->execute(); // it is done

so as you can see protecting your code from malicious input is not hard and it even makes your SQL statements a lot easier to read. Did you notice that you didn't even need to quote your values in the SQL statement anymore? Prepared statements take care of that for you! One less way to have an error in your code.

Please do read up on it, it will save you headaches. PDO even has the advantage that it's database independent, making it easier to use another database with existing code.

于 2012-06-24T22:02:30.197 回答
2

正确的更新sql子句是这样的：

UPDATE table
SET column = expression;

或者

UPDATE table
SET column = expression
WHERE predicates;

SQL：更新语句

您的查询应该是这样的：

$update = "UPDATE sanjana SET $name ='$usernames'";
mysql_query($update, $link);

当然你需要指定一行来更新（id），否则整个表将设置$name列为$usernames.

更新：

因为要在空表中插入数据，所以应先执行 $update1 查询，然后执行 $update 查询。UPDATE子句不会对空表进行更改/插入。

于 2012-06-24T21:56:56.780 回答
2

Problem 1: use the correct "insert into" (create new record) vs. "update" (modify existing record)

Problem 2: It's good practice to create your SQL string before you call mysql_query(), so you can print it out for debugging

Problem 3: It's also good practice to detect errors

EXAMPLE:

<?php
  $link = mysql_connect('xxxxxxxx')
    or die('Could not connect: ' . mysql_error());

  mysql_select_db("xxx", $link);

  $usernames='aneeshxx';
  $sql = "INSERT INTO sanjana (name) VALUES ('" . $usernames + ")";
  echo "sql: " . $sql . "...<br/>\n";
  mysql_query($sql, $link)
    or die(mysql_error());
于 2012-06-24T22:01:37.057 回答
0

您的更新 SQL 有 INSERT 关键字，这应该更改为 UPDATE：

$update = "UPDATE sanjana SET $name ='$usernames'";
于 2012-06-24T21:53:48.857 回答