0

这是我的表单页面 editFormpackage.php
我可以将我的数据带回表单进行更新，但是当我更改值并单击更新时，iformation 不会保存。有人可以帮忙！我是 php 新手。 

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title> AB Delivery </title>
<title> *Please enter details of employee took order. </title>
<link rel="stylesheet" type="text/css" href="style.css" />
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title> AB Delivery </title>
<link rel="stylesheet" type="text/css" href="style.css" />
<link href= rel='stylesheet' type='text/css'>
<!-- jQuery file -->
<script src="js/jquery.min.js"></script>
<script src="js/jquery.tabify.js" type="text/javascript" charset="utf-8"></script>
<script type="text/javascript">
var $ = jQuery.noConflict();
$(function() {
$('#tabsmenu').tabify();
$(".toggle_container").hide(); 
$(".trigger").click(function(){
    $(this).toggleClass("active").next().slideToggle("slow");
    return false;
});
});
</script>
</head>
<body>
<div id="panelwrap">

    <div class="header">
    <div class="title"><a href="#">AB Delivery</a></div>

    <div class="header_right">Welcome Admin </div>

    <div class="menu">
    <ul>
    <li><a href="http://localhost/delivery2/homepage.html" class="selected">New Entry</a></li>
    <li><a href="http://localhost/delivery2/showall.php">Show All</a></li>
    <li><a href="http://localhost/delivery2/edit.php">Edit</a></li>
    <li><a href="http://localhost/delivery2/search.html">Search</a></li>
    </ul>
    </div>


   <div class="center_content">  

    <div id="right_wrap">
    <div id="left_content">             
    <h2>Tables section</h2> 


<table id="rounded-corner">



<?php
$con = mysql_connect("localhost","root","");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("delivery", $con);

if(isset($_GET['package_id']))
{
$package_id=$_GET['package_id'];
if(isset($_POST['submit']))
{
$customer_id=$_POST['customer_id'];
$order_taken_by_employee_id=$_POST['order_taken_by_employee_id'];
$package_details=$_POST['package_details'];
$result=mysql_query("UPDATE package SET customer_id ='$customer_id',order_taken_by_employee_id='$order_taken_by_employee_id', package_details='$package_details' where package_id='$package_id'");
if($result)
{
header('location:edit.php');
}
}
$query1=mysql_query("SELECT * FROM package  WHERE package_id='$package_id'");
$query2=mysql_fetch_array($query1);
?>
<form method="post" action="http://localhost/delivery2/editFormpackage.php">
Customer ID:<input type="text" name="customer_id" value="<?php echo $query2['customer_id']; ?>" /><br />
Order Taken by Employee ID:<input type="text" name="order_taken_by_employee_id" value="<?php echo $query2['order_taken_by_employee_id']; ?>" /><br /><br />
Package Details:<input type="text" name="package_details" value="<?php echo $query2['package_details']; ?>" /><br /><br />
<br />
<input type="submit" name="submit" value="update" />
</form>


<?php
}
?>



 <div 



    <div class="clear"></div>
    </div> <!--end of center_content-->

    <div class="footer">
AB Delivery 
</div>

</div>


</body>
</html>

这是来自edit.php 的代码，您可以看到我为所有要更新的表格创建了一个新页面。

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title> AB Delivery </title>
<title> *Please enter details of employee took order. </title>
<link rel="stylesheet" type="text/css" href="style.css" />
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title> AB Delivery </title>
<link rel="stylesheet" type="text/css" href="style.css" />
<link href= rel='stylesheet' type='text/css'>
<!-- jQuery file -->
<script src="js/jquery.min.js"></script>
<script src="js/jquery.tabify.js" type="text/javascript" charset="utf-8"></script>
<script type="text/javascript">
var $ = jQuery.noConflict();
$(function() {
$('#tabsmenu').tabify();
$(".toggle_container").hide(); 
$(".trigger").click(function(){
    $(this).toggleClass("active").next().slideToggle("slow");
    return false;
});
});
</script>
</head>
<body>
<div id="panelwrap">

    <div class="header">
    <div class="title"><a href="#">AB Delivery</a></div>

    <div class="header_right">Welcome Admin </div>

    <div class="menu">
    <ul>
    <li><a href="http://localhost/delivery2/homepage.html" class="selected">New Entry</a></li>
    <li><a href="http://localhost/delivery2/showall.php">Show All</a></li>
    <li><a href="http://localhost/delivery2/edit.php">Edit</a></li>
    <li><a href="http://localhost/delivery2/search.html">Search</a></li>
    </ul>
    </div>


   <div class="center_content">  

    <div id="right_wrap">
    <div id="left_content">             
    <h2>Tables section</h2> 


<table id="rounded-corner">


<?php
$con = mysql_connect("localhost","root","");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("delivery", $con);

$result = mysql_query("SELECT * FROM customers");



echo "<table border='19'>
<tr>
<th>Customer ID</th>
<th>Customer Address ID</th>
<th>Name</th>
<th>Phone Number</th>
<th>Email</th>
<th>Action</th>
</tr>";

while($row1 = mysql_fetch_array($result))

  {
  echo "<tr>";
  echo "<td>" . $row1['customer_id'] . "</td>";
  echo "<td>" . $row1['customer_address_id'] . "</td>";
  echo "<td>" . $row1['customer_name'] . "</td>";
  echo "<td>" . $row1['customer_phone'] . "</td>";
  echo "<td>" . $row1['customer_email'] . "</td>";
  echo "<td><a href='editFormcustomers.php?customer_id=".$row1['customer_id']."'>Edit</a></td>";
echo "<td><a href='deletecustomers.php?customer_id=".$row1['customer_id']."'>x</a></td><tr>";
  }


echo "</tr>";

echo "</table>";

mysql_close($con);

?>

<?php
$con = mysql_connect("localhost","root","");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("delivery", $con);

$result = mysql_query("SELECT * FROM address");



echo "<table border='19'>
<tr>
<th>Address ID</th>
<th>Address </th>
<th>Action</th>
</tr>";

while($row2 = mysql_fetch_array($result))

  {
  echo "<tr>";
  echo "<td>" . $row2['address_id'] . "</td>";
  echo "<td>" . $row2['line_1'] . "</td>";
  echo "<td><a href='editFormaddress.php?address_id=".$row2['address_id']."'>Edit</a></td>";
echo "<td><a href='deleteaddress.php?address_id=".$row2['address_id']."'>x</a></td><tr>";
  }


echo "</tr>";

echo "</table>";

mysql_close($con);

?>

<?php
$con = mysql_connect("localhost","root","");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("delivery", $con);

$result = mysql_query("SELECT * FROM package");



echo "<table border='19'>
<tr>
<th>Packasge ID</th>
<th> Customer ID</th>
<th>Employee ID</th>
<th>Details</th>
<th>Action</th>
</tr>";

while($row3 = mysql_fetch_array($result))

  {
  echo "<tr>";
  echo "<td>" . $row3['package_id'] . "</td>";
  echo "<td>" . $row3['customer_id'] . "</td>";
  echo "<td>" . $row3['order_taken_by_employee_id'] . "</td>";
  echo "<td>" . $row3['package_details'] . "</td>";
    echo "<td><a href='editFormpackage.php?package_id=".$row3['package_id']."'>Edit</a></td>";
echo "<td><a href='deletepackage.php?package_id=".$row3['package_id']."'>x</a></td><tr>";


  }


echo "</tr>";

echo "</table>";

mysql_close($con);

?>

<?php
$con = mysql_connect("localhost","root","");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("delivery", $con);

$result = mysql_query("SELECT * FROM employee");



echo "<table border='19'>
<tr>
<th>Employee ID</th>
<th>Employee Name</th>
<th>Phone Number</th>
<th>Other Details</th>
<th>Action</th>
</tr>";

while($row4 = mysql_fetch_array($result))

  {
  echo "<tr>";
  echo "<td>" . $row4['employee_id'] . "</td>";
  echo "<td>" . $row4['employee_name'] . "</td>";
  echo "<td>" . $row4['employee_phone'] . "</td>";
  echo "<td>" . $row4['other_employee_details'] . "</td>";
    echo "<td><a href='editFormemployee.php?employee_id=".$row4['employee_id']."'>Edit</a></td>";
echo "<td><a href='deleteemployee.php?employee_id=".$row4['employee_id']."'>x</a></td><tr>";

  }


echo "</tr>";

echo "</table>";


mysql_close($con);

?>


  <div 



    <div class="clear"></div>
    </div> <!--end of center_content-->

    <div class="footer">
AB Delivery 
</div>

</div>


</body>
</html>
4

2 回答 2

0

这是正确的代码： 

 <form method="post" action="http://localhost/delivery2/editFormpackage.php">
         Customer ID:<input type="text" name="customer_id" value="<?php echo     $query2['customer_id']; ?>" /><br />
        Order Taken by Employee ID:<input type="text" name="order_taken_by_employee_id" value="<?php echo $query2['order_taken_by_employee_id']; ?>" /><br /><br />
        Package Details:<input type="text" name="package_details" value="<?php echo $query2['package_details']; ?>" /><br /><br />
        <br />
        <input type="hidden" name="package_id" value="<?php echo $query2['package_id'];?>" />
        <input type="submit" name="submit" value="update" />
        </form>
于 2013-04-24T01:49:56.057 回答
0

更新脚本中的 where 子句引用了包 ID，但是在表单中没有设置包 ID。

$result=mysql_query("UPDATE package SET customer_id ='$customer_id',order_taken_by_employee_id='$order_taken_by_employee_id', package_details='$package_details' where package_id='$package_id'");

在我们找到解决方案之前，我必须指出您非常容易受到 SQL 注入的影响，因为您在直接使用数据库之前没有对表单输入进行清理。看看这个，以帮助你在正确的轨道上http://us2.php.net/manual/en/function.mysql-real-escape-string.php

下面的解决方案可以工作，但在 POST 中传递包 id 在技术上也可以被黑客入侵。在服务器或数据库会话中传递 ID 是最安全的（使用 PHP 在两个页面之间传递变量的最安全方法），但是下面的解决方案将使您顺利上路。

您正在从 GET 查询参数设置包 ID，但是一旦您的表单提交，它将提交到表单操作参数中定义的 URL，如您所见，该 URL 仍不包含包 ID。

要解决这个问题，您应该将 package_id 添加为隐藏的表单变量，如下所示：

<form method="post" action="http://localhost/delivery2/editFormpackage.php">
 Customer ID:<input type="text" name="customer_id" value="<?php echo     $query2['customer_id']; ?>" /><br />
Order Taken by Employee ID:<input type="text" name="order_taken_by_employee_id" value="<?php echo $query2['order_taken_by_employee_id']; ?>" /><br /><br />
Package Details:<input type="text" name="package_details" value="<?php echo $query2['package_details']; ?>" /><br /><br />
<br />
<input type="hidden" name="package_id" value="<?php echo $query2['package_id'];?>" />
<input type="submit" name="submit" value="update" />
</form>

然后从 $_POST 超全局中的 package_id 设置 package_id，如下所示：

if(isset($_POST['submit']))
{
$package_id = $_POST['package_id'];
$customer_id=$_POST['customer_id'];
$order_taken_by_employee_id=$_POST['order_taken_by_employee_id'];
$package_details=$_POST['package_details'];
$result=mysql_query("UPDATE package SET customer_id ='$customer_id',order_taken_by_employee_id='$order_taken_by_employee_id', package_details='$package_details' where package_id='$package_id'");
// rest of your code
于 2013-04-23T05:07:04.117 回答