-4

我知道有很多关于这个的问题,我一直在寻找我的解决方案几个小时,我似乎无法找到我的代码有什么问题,除了看到 mysql_query 应该更改为 mysqli_query 但是当我改变它给了我更多的错误信息,我不知道现在还能尝试什么。如果可以,请提供帮助,这开始占用我很多时间。谢谢!(不要批评说“有很多相同的问题”,我认为每个人最终都会发布他们的问题,因为他们找不到问题的答案,因为它与其他问题不匹配,至少在我的情况下,我在询问之前查看没有成功。)

 // try get "MySQL link identifier" 
    $dbConn = mysql_connect($serverName, $user_name, $password) or die("Cannot connect to server<br />\n MySQL error ==>" . mysql_errno() . "<== : ==>" . mysql_error() . "<== <br />\n"); 
    print ""; 

// try connect to database 
mysql_select_db($db_name, $dbConn) or die("Cannot connect to database<br />\n MySQL error ==>" . mysql_errno($dbConn) . "<== : ==>" . mysql_error($dbConn) . "<== <br />\n"); 
print "<br />\n"; 


// Retrieve data from database 
$id = $_GET['id'];
$additional_notes = $_GET['additional_notes'];

// update data in mysql database 
$sql=("UPDATE `rmstable2` SET `additional_notes` = '$additional_notes' WHERE `id` = '$id'");
$result = mysql_query($sql) or die(mysql_error());

$resultcount = mysql_affected_rows($result);


if ($resultcount == 1) {

mysql_query("UPDATE `rmstable2` SET `additional_notes` = '$additional_notes' WHERE `id` = '$id'") or die(mysql_error());

} 

// if successfully updated. 
if($result)
{
echo "Update Successful!";
 echo '<h3>Your case has been updated.</h3>'; 
 echo "To see your changes please click <a href='/fullcase.php?id=$id'>here</a></b>";
}
else {
echo "ERROR";
}

?>
4

2 回答 2

2

传递 UPDATE 查询时,mysql_query()返回布尔值 TRUE 表示成功,FALSE 表示失败,同时mysql_num_rows()只接受结果集资源作为其参数。为了确定 UPDATE 查询影响了多少行,请mysql_affected_rows()使用连接资源作为其参数进行调用。

它不会导致您现在遇到的问题,但是建议您附加or die(mysql_error())到您的mysql_query()调用中,以捕获发生的任何 MySQL 错误。更好的建议是mysql_*完全放弃这些函数,转而支持 PHP 手册中所推荐的 PHP PDO 扩展,并且它确实不会产生更多的认知开销,以换取它在功能和安全性方面提供的巨大好处。

撇开这一点不谈,以下是我将如何更改您的代码,使其表现得更像您的想法:

<?php
// obtain a database connection
$dbConn = mysql_connect($serverName, $user_name, $password) 
  or die("Cannot connect to server: " . mysql_error() . "<br />\n"); 
  // mysql error number rarely adds enough information to be worth including

// select the database
mysql_select_db($db_name, $dbConn) 
  or die("Couldn't select $db_name: " . mysql_error() . "<br />\n"); 

// obtain escaped versions of query data for inclusion in update query
// it is imperative to use mysql_real_escape_string() or equivalent if you're
// going to use mysql_* functions instead of the far preferable PDO 
// prepared statements; if you don't escape your data, you leave open the
// possibility of SQL injection, which someone will certainly soon use to
// screw up your website horribly
$id = mysql_real_escape_string($_GET['id']);
$additional_notes = mysql_real_escape_string($_GET['additional_notes']);

// assemble query to pass to mysql_query()
// no need for parentheses around the string; in fact i'm surprised that
// didn't result in a parse error
// also FYI re backticks, MySQL uses them to denote literal database/table/
// column names -- they're optional unless required to disambiguate between
// an entity name and a reserved word. for example, you can create a table
// containing a column named 'key', which is a MySQL reserved word, but you
// thereafter must refer to that column as `key`, with backticks, in any
// queries, to hint to MySQL's parser that you mean the column by that name
// and not the reserved word; otherwise, it's a parse error.
$sql = "UPDATE `rmstable2` SET `additional_notes` = '$additional_notes' WHERE `id` = '$id'";

// actually run the query
// this being an UPDATE query, the result is boolean and offers no 
// additional useful information, so you need not capture it in a variable; 
// the 'or die' clause will fire if it's false, and if it's true, you'll 
// use mysql_affected_rows() to get the additional info you need.
mysql_query($sql)
  or die(mysql_error());

// if the query failed, the script die()d on the previous line and didn't 
// get here; if it did get here, you know the query succeeded
$resultcount = mysql_affected_rows($dbConn);

// this is technically correct but semantically odd; since you already included
// the 'additional_notes' value in the previous UPDATE query, and since
// that query certainly succeeded if we're evaluating this code at all, 
// why run the same query again?
if ($resultcount == 1) {
  mysql_query("UPDATE `rmstable2` SET `additional_notes` = '$additional_notes' WHERE `id` = '$id'") 
    or die(mysql_error());
} 

// again, the 'or die' clauses mean that we can only have reached this point
// if the queries succeeded, so there's no need for an if() test here
echo "Update Successful!";
echo '<h3>Your case has been updated.</h3>'; 
// note the backslashes before the embedded double quotes; single quotes in
// tag attributes are technically invalid but most browsers will accept them,
// but you can use double quotes within a double-quoted string if you precede
// the embedded quotes with backslashes (called "escaping") to indicate that
// they're not to be taken as the end of the string
// (i.e., "\"\"" == '""')
echo "To see your changes please click <a href=\"/fullcase.php?id=$id\">here</a></b>";
?>
于 2013-05-30T18:43:24.760 回答
-1

亚历山德拉,

尽管如此,这并不能解决你所有的错误。它有有用的评论,将帮助您在确切的问题上归零。您可以执行此操作并让我知道您实际看到的内容吗?

// try get "MySQL link identifier" 
$dbConn = mysql_connect($serverName, $user_name, $password) or die("Cannot connect to server<br />\n MySQL error ==>" . mysql_errno() . "<== : ==>" . mysql_error() . "<== <br />\n"); 
print ""; 

// try connect to database 
mysql_select_db($db_name, $dbConn) or die("Cannot connect to database<br />\n MySQL error ==>" . mysql_errno($dbConn) . "<== : ==>" . mysql_error($dbConn) . "<== <br />\n"); 
print "<br />\n"; 


// Retrieve data from database 
$id = $_GET['id'];
$additional_notes = $_GET['additional_notes'];

// Assuming id is always numeric you could sanitize and validate it like below
$id = intval($_GET['id']);
if( $id<=0 ){
  // Let user know or redirect to a page when id is not present
  // Or even better do not run the queries at all
}

// update data in mysql database 
//$sql=("UPDATE `rmstable2` SET `additional_notes` = '$additional_notes' WHERE `id` = '$id'");

// Escape strings; you could try something like this
$sql=("UPDATE `rmstable2` SET `additional_notes` = '" . mysql_escape_string($additional_notes) . "' WHERE `id` = '$id'");

// 仅用于调试(更好的做法是使用 error_log) echo '

SQL:'。$sql 。'
';

$result = mysql_query($sql);

if($result){
  //$resultcount = mysql_num_rows($result);

  // Instead
  $resultcount = mysql_affected_rows($result);

  if ($resultcount == 1) {

    mysql_query("UPDATE `rmstable2` SET 
                                  `additional_notes` = '$additional_notes'

                               WHERE `id` = '$id'") 

       or die(mysql_error());

  }else{
    // Nothing was updated
    // maybe rows didn't match?
    echo "No data was updated.";
  }
}else{
  // mysql_query returned FALSE
  // There must be an error
  echo "DB Error: " . mysql_error();
}
// if successfully updated. 
if($result){
  echo "Update Successful!";
 echo '<h3>Your case has been updated.</h3>'; 
 echo "To see your changes please click <a href='/fullcase.php?id=$id'>here</a></b>";
}else {
  echo "ERROR";
}
于 2013-05-30T18:53:34.003 回答