1

我有一个网站 www.jazz.eu。我将该站点的精确副本复制到另一个具有不同域名的另一个服务器中。新的是 www.vetur.nl。

一切正常（我的意思是类似于 jazz.eu）。除了购物车流程。首先，当我看到购物车时，我总是有一条空产品线。我无法删除它。明白了吗

http://www.vetur.nl/cart_empty_product_line.jpg

我遇到的下一个问题是，当我尝试刷新购物车或发送订单时，我会收到此消息

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near
'sender_full_name='',sender_afm='',sender_doy='',sender_work='',sender_person='',' at line 1
query=update basket set selected_quantity=,sender_full_name='' ,sender_afm='',sender_doy='',sender_work='',sender_person='',sender_address='',sender_zip='',sender_tel='',sender_fax='', addresser_email='', additional='' where session_id = 'ihcvafpk3fgqh6jra1mrplgkr1' and id=

我认为问题出在这个文件 process.php 但我找不到它。确切的文件在我的第一个站点 jazz.eu 中运行良好。似乎有问题的 process.php 代码如下。感谢您并原谅发布中的任何错误。这是我第一次在这里发帖。

    function procMy_cart(){
        global $session, $form,$database,$mailer;

        $session_id = session_id();
        if ((isset($_POST['order'])) && ($_POST['order']==1)) {
            if (!eregi("[a-z\α-ω\!\"\£\$\%\^\&\*\(\)\-\+\{\}\:\;\'\@\~\#\\\|\<\>\?\/]", $_POST['update_quantity'][$i])) {
                        For ($i=0;$i<count($_POST['update_quantity']);$i++) {

                    if (!eregi("[a-z\α-ω\!\"\£\$\%\^\&\*\(\)\-\+\{\}\:\;\'\@\~\#\\\|\<\>\?\/]", $_POST['update_quantity'][$i])) {
                        //$update_db="update basket set selected_quantity=".$_POST['update_quantity'][$i].",addresser='".$_POST['addresser']."',addresser_tel='".$_POST['addresser_tel']."', addresser_email='".$_POST['addresser_email']."', additional='".$_POST['additional']."' where session_id = '$session_id' and id=".$_POST['update_id'][$i]."";
                        $update_db="update basket set selected_quantity=".$_POST['update_quantity'][$i].",sender_full_name='".$_POST['addresser']."',sender_afm='".$_POST['addresser_afm']."',sender_doy='".$_POST['addresser_doy']."',sender_work='".$_POST['addresser_work']."',sender_person='".$_POST['addresser_contact']."',sender_address='".$_POST['addresser_address']."',sender_zip='".$_POST['addresser_zip']."',sender_tel='".$_POST['addresser_tel']."',sender_fax='".$_POST['addresser_fax']."', addresser_email='".$_POST['addresser_email']."', additional='".$_POST['additional']."' where session_id = '$session_id' and id=".$_POST['update_id'][$i]."";
                        $result=$database->query($update_db);

                    } else {

                        //$update_db="update basket set selected_quantity=1,addresser='".$_POST['addresser']."',addresser_tel='".$_POST['addresser_tel']."',addresser_email='".$_POST['addresser_email']."', additional='".$_POST['additional']."' where session_id = '$session_id' and id=".$_POST['update_id'][$i]."";
                        $update_db="update basket set selected_quantity=1,sender_full_name='".$_POST['addresser']."',sender_afm='".$_POST['addresser_afm']."',sender_doy='".$_POST['addresser_doy']."',sender_work='".$_POST['addresser_work']."',sender_person='".$_POST['addresser_contact']."',sender_address='".$_POST['addresser_address']."',sender_zip='".$_POST['addresser_zip']."',sender_tel='".$_POST['addresser_tel']."',sender_fax='".$_POST['addresser_fax']."', addresser_email='".$_POST['addresser_email']."', additional='".$_POST['additional']."' where session_id = '$session_id' and id=".$_POST['update_id'][$i]."";
                        $result=$database->query($update_db);
                    }
                }
            }
//          $retval = $session->my_cart($_POST['addresser'], $_POST['addresser_doy'], $_POST['addresser_work'], $_POST['addresser_afm'], $_POST['addresser_address'], $_POST['addresser_zip'], $_POST['addresser_contact'], $_POST['addresser_email'], $_POST['addresser_tel'], $_POST['addresser_fax'], $_POST['additional']);
//          if ($retval) {
//               $_SESSION['send_order'] = true;
//              header("Location: my_cart2.php");//.$session->referrer);
//          } else {
//              $_SESSION['value_array'] = $_POST;
//              $_SESSION['error_array'] = $form->getErrorArray();
//              header("Location: my_cart2.php");//.$session->referrer);
//          }
        header("Location: order2.php");

        } else if ((isset($_POST['order'])) && ($_POST['order']!=1)) {
            if ((isset($_POST['refresh_basket'])) && ($_POST['refresh_basket']==1)) {
                For ($i=0;$i<count($_POST['update_quantity']);$i++) {
                    //echo $_POST['update_id'][$i];
                    if (!eregi("[a-z\α-ω\!\"\£\$\%\^\&\*\(\)\-\+\{\}\:\;\'\@\~\#\\\|\<\>\?\/]", $_POST['update_quantity'][$i])) {
                        //$update_db="update basket set selected_quantity=".$_POST['update_quantity'][$i].", addresser='".$_POST['addresser']."', addresser_tel='".$_POST['addresser_tel']."',  addresser_email='".$_POST['addresser_email']."', additional='".$_POST['additional']."' where session_id = '$session_id' and id=".$_POST['update_id'][$i]."";
                        $update_db="update basket set selected_quantity=".$_POST['update_quantity'][$i].",sender_full_name='".$_POST['addresser']."',sender_afm='".$_POST['addresser_afm']."',sender_doy='".$_POST['addresser_doy']."',sender_work='".$_POST['addresser_work']."',sender_person='".$_POST['addresser_contact']."',sender_address='".$_POST['addresser_address']."',sender_zip='".$_POST['addresser_zip']."',sender_tel='".$_POST['addresser_tel']."',sender_fax='".$_POST['addresser_fax']."', addresser_email='".$_POST['addresser_email']."', additional='".$_POST['additional']."' where session_id = '$session_id' and id=".$_POST['update_id'][$i]."";
                        $result=$database->query($update_db);

                    } else {
                        //$update_db="update basket set selected_quantity=1, addresser='".$_POST['addresser']."', addresser_tel='".$_POST['addresser_tel']."',  addresser_email='".$_POST['addresser_email']."', additional='".$_POST['additional']."' where session_id = '$session_id' and id=".$_POST['update_id'][$i]."";
                        $update_db="update basket set selected_quantity=1,sender_full_name='".$_POST['addresser']."',sender_afm='".$_POST['addresser_afm']."',sender_doy='".$_POST['addresser_doy']."',sender_work='".$_POST['addresser_work']."',sender_person='".$_POST['addresser_contact']."',sender_address='".$_POST['addresser_address']."',sender_zip='".$_POST['addresser_zip']."',sender_tel='".$_POST['addresser_tel']."',sender_fax='".$_POST['addresser_fax']."', addresser_email='".$_POST['addresser_email']."', additional='".$_POST['additional']."' where session_id = '$session_id' and id=".$_POST['update_id'][$i]."";
                        $result=$database->query($update_db);
                    }
                }
            }
            $_SESSION['value_array'] = $_POST;
            $_SESSION['error_array'] = $form->getErrorArray();
            header("Location: my_cart2.php");//.$session->referrer);
        }
    } // end cart
4

1 回答 1

0

该变量$_POST['update_quantity'][$i]没有值。如果您查看查询，您会注意到set selected_quantity=,sender_full_name=''. 您至少需要一组单引号或null分配给 selected_quantity。

您永远不应该将 _POST 数据直接分配到查询中。总是以某种方式擦洗它以避免 SQL 注入攻击。您可能应该尽早将 $_POST['update_quantity'][$i] 分配给变量并执行一些逻辑以确保它具有有效值，如果没有，则阻止查询运行或添加默认值。

于 2013-08-09T17:13:11.590 回答