0

我已经用逗号和“AND”语句尝试了这个查询，如下图所示。我收到语法错误

出了点问题。您的 SQL 语法有误；检查与您的 MySQL 服务器版本相对应的手册，以'are available 24/7 by phone and email to answer any questions and to assist you '在第 1 行附近使用正确的语法

每次我尝试这个查询：

$sql = mysql_query("UPDATE general
    SET bookabandheading = $_POST[bookabandheading 
    AND bookaband = $_POST[bookaband]
    AND contactus = $_POST[contactus]
    AND aboutuslisten = $_POST[aboutuslisten]
    AND contactusheading = $_POST[contactusheading]
    AND nightclubsheading = $_POST[nightclubsheading]
    AND acousticheading = $_POST[acousticheading]
    AND schoolsheading = $_POST[schoolsheading]
    AND privateheading = $_POST[privateheading]
    AND concertsheading = $_POST[concertsheading]
    AND festivalsheading = $_POST[festivalsheading]
    AND submissions = $_POST[submissions]
    AND interns = $_POST[interns]
    AND managementbio = $_POST[managementbio]
    AND latestnews = $_POST[latestnews]
    AND artistofthemonth = $_POST[artistofthemonth]
    AND artistofthemonthphoto = $_POST[artistofthemonthphoto]
    AND artistofthemonthid = $_POST[artistofthemonthid]
    AND listentoourartists = $_POST[listentoourartists]
    AND musicianswanted = $_POST[musicianswanted]
    AND aboutus = $_POST[aboutus]
    AND bshowcases = $_POST[bshowcases]
    AND bandavails = $_POST[bandavails]");

该查询在另一个 VPS 上的不同数据库中工作，但我只是迁移了服务器，它不再工作。非常感谢任何帮助！

4

4 回答 4

5

虽然主要问题是您在 bookamandheading 之后错过了右括号，但我仍然建议您重构此请求，例如：

$keys = array("bookabandheading", "bookaband", "contactus", "aboutuslisten",
              "contactusheading", "nightclubsheading", "acousticheading",
              "schoolsheading", "privateheading", "concertsheading",
              "festivalsheading", "submissions", "interns", "managementbio",
              "latestnews", "artistofthemonth", "artistofthemonthphoto",
              "artistofthemonthid", "listentoourartists", "musicianswanted",
              "aboutus", "bshowcases", "bandavails");
$set = array();
foreach ($keys as $key) {
    $set[] = sprintf(" %s = '%s' ", $key, mysql_escape_string($_POST[$key]));
}
$sql = mysql_query("UPDATE general SET " . implode(", ", $set));

通过转义输入，维护起来更容易，也更安全。

更新：添加 where 语句示例

$where = array();
$where[] = sprintf(" some_string = '%s' ", mysql_escape_string($some_string));
$where[] = sprintf(" some_integer = %d ", $some_integer);
$where = " WHERE " . implode(" AND ", $where);
$sql = mysql_query("UPDATE general SET " . implode(", ", $set) . " " . $where);
于 2013-10-14T23:25:51.870 回答
1

我认为这有 3 个问题：

  • 查询中的原始 POST 数据 - 至少是用户 mysql_real_escape_string
  • 参数看起来像字符串，所以应该在它们周围加上引号
  • 没有 WHERE 选项，因此您将更新该表中的每一行
于 2013-10-14T23:18:08.323 回答
1

你有几个错误：

  • 语法错误。改变

    $_POST[bookabandheading到$_POST[bookabandheading]

  • 这也非常容易发生 SQL 注入。您应该使用 mysqli，但如果您设置在 mysql 上（从 5.5.0 开始不推荐使用），您应该使用 mysql_real_escape_string() 转义每个 $_POST 变量。

  • 每个 $_POST 变量都需要使用引号进行参数化。所以，举个例子：

    $_POST['bookabandheading']（对所有 $_POST 变量执行此操作）

于 2013-10-14T23:21:46.297 回答
0 
$_POST[bookabandheading

改成

$_POST[bookabandheading]
于 2013-10-14T23:14:37.140 回答