php - PHP/MySQL 允许当前用户编辑他们的帐户信息

Question

我创建了 2 个页面

update.php
edit.php

我们从 edit.php 开始，所以这里是 edit.php 的脚本

<?php
session_start();
$id = $_SESSION["id"];
$username = $_POST["username"];
$fname = $_POST["fname"];
$password = $_POST["password"];
$email = $_POST["email"];

mysql_connect('mysql13.000webhost.com', 'a2670376_Users', 'Password') or     die(mysql_error());
echo "MySQL Connection Established! <br>";

mysql_select_db("a2670376_Pass") or die(mysql_error());
echo "Database Found! <br>";

$query = "UPDATE members SET username = '$username', fname = '$fname', 
password = '$password' WHERE id = '$id'";

$res = mysql_query($query);

if ($res)
echo "<p>Record Updated<p>";
else
echo "Problem updating record. MySQL Error: " . mysql_error();
?>

<form action="update.php" method="post">
<input type="hidden" name="id" value="<?=$id;?>">
ScreenName:<br> <input type='text' name='username' id='username' maxlength='25'   style='width:247px' name="username" value="<?=$username;?>"/><br>
FullName:<br> <input type='text' name='fname' id='fname' maxlength='20' style='width:248px'     name="ud_img" value="<?=$fname;?>"/><br>
Email:<br> <input type='text' name='email' id='email' maxlength='50' style='width:250px'    name="ud_img" value="<?=$email;?>"/><br>
Password:<br> <input type='text' name='password' id='password' maxlength='25'     style='width:251px' value="<?=$password;?>"/><br>
<input type="Submit">
</form>

现在这是我遇到主要问题的 update.php 页面

<?php
session_start();
mysql_connect('mysql13.000webhost.com', 'a2670376_Users', 'Password') or   die(mysql_error());
mysql_select_db("a2670376_Pass") or die(mysql_error());

$id = (int)$_SESSION["id"];

$username = mysql_real_escape_string($_POST["username"]);
$fname = mysql_real_escape_string($_POST["fname"]);
$email = mysql_real_escape_string($_POST["email"]);
$password = mysql_real_escape_string($_POST["password"]);


$query="UPDATE members
SET username = '$username', fname = '$fname', email = '$email', password = '$password'
WHERE id='$id'";


mysql_query($query)or die(mysql_error());
if(mysql_affected_rows()>=1){
echo "<p>($id) Record Updated<p>";
}else{
echo "<p>($id) Not Updated<p>";
}
?>

现在在edit.php上，我填写表格以编辑帐户“test”，而我现在登录它，一旦表格填写完毕，我点击提交按钮，它需要我更新.php并返回这个

(0) Not Updated  

(0) <= id of user logged in

Not Updated <= MySql Error from  


mysql_query($query)or die(mysql_error());
if(mysql_affected_rows()>=1){

我希望它更新登录的用户，如果我在这个脚本中没有记错的话，它会说

  $id = (int)$_SESSION["id"];

它使用登录人的 id 更新用户

但它没有更新，它说没有表受到影响

如果有帮助，这是我的 MySQL 数据库图片，请单击此处 http://i50.tinypic.com/21juqfq.png

如果这可能有助于找到解决方案，我还有 2 个文件 delete.php 和 delete_ac.php 他们可以从我的 sql 数据库中删除用户并显示用户 ID，并且它可以正常工作，这个脚本中没有任何错误请不要对下面的脚本提出建议 delete.php 首先

    <?php

$host="mysql13.000webhost.com"; // Host name 
$username="a2670376_Users"; // Mysql username 
$password="PASSWORD"; // Mysql password 
$db_name="a2670376_Pass"; // Database name 
$tbl_name="members"; // Table name 

// Connect to server and select database.
mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB");

// select record from mysql 
$sql="SELECT * FROM $tbl_name";
$result=mysql_query($sql);
?>

<table border="0" cellpadding="3" cellspacing="1" bgcolor="#CCCCCC">
<tr>
<td colspan="8" style="bgcolor: #FFFFFF"><strong><img src="http://i47.tinypic.com/u6ihk.png" height="30" widht="30">Delete data in mysql</strong> </td>
</tr>

<tr>
<td align="center" bgcolor="#FFFFFF"><strong>Id</strong></td>
<td align="center" bgcolor="#FFFFFF"><strong>UserName</strong></td>
<td align="center" bgcolor="#FFFFFF"><strong>FullName</strong></td>
<td align="center" bgcolor="#FFFFFF"><strong>Password</strong></td>
<td align="center" bgcolor="#FFFFFF"><strong>Email</strong></td>
<td align="center" bgcolor="#FFFFFF"><strong>Date</strong></td>
<td align="center" bgcolor="#FFFFFF"><strong>Ip</strong></td>
<td align="center" bgcolor="#FFFFFF">&nbsp;</td>
</tr>

<?php
while($rows=mysql_fetch_array($result)){
?>

<tr>
<td bgcolor="#FFFFFF"><? echo $rows['id']; ?></td>
<td bgcolor="#FFFFFF"><? echo $rows['username']; ?></td>
<td bgcolor="#FFFFFF"><? echo $rows['fname']; ?></td>
<td bgcolor="#FFFFFF"><? echo $rows['password']; ?></td>
<td bgcolor="#FFFFFF"><? echo $rows['email']; ?></td>
<td bgcolor="#FFFFFF"><? echo $rows['date']; ?></td>
<td bgcolor="#FFFFFF"><? echo $rows['ip']; ?></td>
<td bgcolor="#FFFFFF"><a href="delete_ac.php?id=<? echo $rows['id']; ?>">delete</a></td>
</tr>

<?php
// close while loop 
}
?>

</table>

<?php
// close connection; 
sql_close();
?>

现在 delete_ac.php

<table width="500" border="0" cellpadding="3" cellspacing="1" bgcolor="#CCCCCC">
<tr>
<td colspan="8" bgcolor="#FFFFFF"><strong><img src="http://t2.gstatic.com/images?           q=tbn:ANd9GcS_kwpNSSt3UuBHxq5zhkJQAlPnaXyePaw07R652f4StmvIQAAf6g" height="30"     widht="30">Removal Of Account</strong> </td>
</tr>

<tr>
<td align="center" bgcolor="#FFFFFF">
<?php

$host="mysql13.000webhost.com"; // Host name 
$username="a2670376_Users"; // Mysql username 
$password="javascript00"; // Mysql password 
$db_name="a2670376_Pass"; // Database name 
$tbl_name="members"; // Table name 

// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB");

// get value of id that sent from address bar 
$id=$_GET['id'];

// Delete data in mysql from row that has this id 
$sql="DELETE FROM $tbl_name WHERE id='$id'";
$result=mysql_query($sql);

// if successfully deleted
if($result){
echo "Deleted Successfully";
echo "<BR>";
echo "<a href='delete.php'>Back to main page</a>";
}

else {
echo "ERROR";
}
?> 

<?php
// close connection 
mysql_close();
?>
</td>
</tr>
</table>

score 1 · Accepted Answer

尝试以下查询，并在此处发布输出。还要在 phpmyadmin 中执行相同的回显查询以查看发生了什么。

echo $query="UPDATE members
SET username = '$username', fname = '$fname', email = '$email', password = '$password'
WHERE id=$id";

从您的链接看来，任何人都可以直接进入编辑页面，这是错误的。

您需要添加条件，如果用户登录，那么只有他可以更新他的个人资料。

score 0 · Accepted Answer

如果 $id 实际上设置为某个值而不是空值，您能否检查 edit.php？可能是 id 从未存储在会话中

score 0 · Accepted Answer

现在你的 $id 是空的。(int)$id 为 0。因此，当您尝试更新 WHERE id=$id 时，您基本上是在说 WHERE id=0 如果 id 是自动增量整数，那么您将不会有 id=0 并且不会更新任何内容. 您需要通过在其中放入一些东西来创建 $_SESSION['id'] 。$_SESSION['id'] = XXXX;

score 0 · Accepted Answer

$sqlshow =@ mysqli_query($con,"SELECT `id`, `Registration_No`, `First_Name`, `Middle_Name`, `Sir_Name`, `Sex`, `Birth_Day`, `Email`, `Address`, `Phone` FROM `cdtistudent` WHERE id=40"); while($row = @mysqli_fetch_object($sqlshow)) {

update.php page

if(isset($_POST["update"])){
	
	$Registration = $_POST['Registration'];
	$First_Name = $_POST['First'];
	$Middle_Name = $_POST['Middle'];
	$Sir_Name = $_POST['Sir'];
	$Sex = $_POST['Sex'];
	$Birth_Day = $_POST['Birth'];
	$Email = $_POST['Email'];
	$Address = $_POST['Address'];
	$Phone=$_POST['Phone'];
	$id=$_POST['id'];
	
	
	$sqlupdate =mysqli_query($con,"UPDATE  cdtistudent
	SET 
	Registration_No='$Registration',
	First_Name='$First_Name',
	Middle_Name='$Middle_Name',
	Sir_Name='$Sir_Name',
	Sex='$Sex',
	Birth_Day='$Birth_Day',
	Email='$Email',
	Address='$Address',
	Phone='$Phone'
	WHERE id='$id'");
	
	if($sqlupdate  === false){
			
			die("".mysqli_error($con));

	
}}

它看起来像
UPDATE cdtistudentSET id=[value-1], Registration_No=[value-2]
, First_Name=[value-3], Middle_Name=[value-4], Sir_Name=[value-5],
Sex=[value-6], Birth_Day=[value -7], Email=[value-8], Address=[value-9], Phone=[value-10] WHERE id=?;

和edit.php页面

$sqlshow =@ mysqli_query($con,"SELECT `id`, `Registration_No`, `First_Name`, `Middle_Name`, `Sir_Name`, `Sex`, `Birth_Day`, `Email`, `Address`, `Phone` FROM `cdtistudent`
                WHERE id=40");
	
	while($row = @mysqli_fetch_object($sqlshow))
	{

php - PHP/MySQL 允许当前用户编辑他们的帐户信息

4 回答 4

Related

Reference