php表单未在mySQL中更新数据库

Question

I have created a table to display the top 10 high scores for a game by the users. i am trying to create a form which allows the user to enter their new high score in the form, hit submit, then the database is updated and the new leaderboard with the newly entered high score is displayed. but when i go to change the high score the database isnt updated and the table doesnt change. this is really frustraiting me and if anyone knows why this could be happening and could give some advice that would be great. my code is below/

<?php

class DatabaseManager
    {
        private $servername = "localhost";
        private $username = "root";
        private $password = "";
        private $dbname = "sokodatabase";
        private $dbc;

        function __construct() {
            $this->dbc = mysqli_connect($this->servername, $this->username, $this->password, $this->dbname);
        }

        function __destruct() {
            mysqli_close($this->dbc);
        }

        public function SelectHighScores(){
            // Create a query for the database
            $query = "
                    SELECT username, highScores, rankNo
                    FROM users, leaderboardhighscores
                    WHERE users.id = leaderboardhighscores.userId
                    ORDER BY highScores desc
                    LIMIT 10";

            // Get a response from the database by sending the connection
            // and the query
            $response = @mysqli_query($this->dbc, $query);

            // If the query executed properly proceed
            if($response){
                echo '<table>
                <tr><td><b>Rank</b></td>
                <td><b>Username</b></td>
                <td><b>High Score</b></td></tr>';


                // mysqli_fetch_array will return a row of data from the query
                // until no further data is available
                while($row = mysqli_fetch_array($response)){
                    echo '<tr><td>' .
                    $row['rankNo'] . '</td><td>' .
                    $row['username'] . '</td><td>' .
                    $row['highScores'] . '</td><td>';

                    echo '</tr>';
                }

                echo '</table>';
            } else {
                echo "Couldn't issue database query<br />";
            }
        }
    }
?>    

my html with php to create form...

                <div class = "leaderboard">
                        <?php

    // Get a connection for the database

    require_once('../sokodatabase.php');
    $manager = new DatabaseManager;
    $manager->SelectHighScores(); 

    //if(isset($_POST['submit'])){

          //require_once('../sokodatabase.php');  
            if ($_SERVER['REQUEST_METHOD'] === 'POST') {
                    $query = "
                    UPDATE leaderboardHighScores
                    SET highScores=".$_POST["highScores"].", rankNo=".$_POST["rankNo"]."
                    WHERE userId=".$_POST["userId"];

                //var_dump($_POST); 
                //echo $query;

                @mysqli_query($this, $query);
            }
    //}       


    ?>

    <form method="post" action="highScores.php">
        high score <input type="text" name="highScores"/>
        rankNo <input type="text" name="rankNo"/>
        userId <input type="text" name="userId"/>
        <input type="submit" value="Submit">
    </form>
                </div>

Answer 1

First off, for security measures, always sanitize user input before using in a query.

Second, you also don't need the @ before mysqli_query - unless your trying to suppress any and all erorrs/warnings thrown by the function.

Third, try and use the same cases for your SQL; you used leaderboardhighscores in the class, and then leaderboardHighScores in the second part of your code; I don't know which one's the real name in the database but will assume for former is since that is working as you say. I'm saying this because case-sensitivity could result an issue, please read MySQL docs on this matter.

Fourth, you are using $this outside of a class on a page where it has no meaning (if not another).

Add this function to the DatabaseManager class:

public function SetHighScores($uid, $score, $rank) {
    $uid   = mysql_real_escape_string($uid);
    $score = mysql_real_escape_string($score);
    $rank  = mysql_real_escape_string($rank);

    $query = "UPDATE leaderboardhighscores SET highScores='{$score}', rankNo='{$rank}' WHERE userId='{$uid}';";

    return mysqli_query($this->dbc, $query);
}

And then this would go on your page:

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $manager->SetHighScores($_POST['userId'], $_POST['highScores'], $_POST['rankNo']);
}

Also, you should look into PDO_MYSQL , would be a better option to go for, but I understand what you're doing is good for learning the basics I guess.

Answer 2

Try this then

$result = mysqli_query($manager->dbc, $query);
if ( ! $result ) {
    echo 'Error code ' 
         . mysqli_errno($manager->dbc)
         . ' Error message ' 
         . mysqli_error($manager->dbc);
}

As $manager is the variable that is holding your DatabaseManager class's object instance within the scope of the code that is executing, and that object has a property called dbc that contains the database connection handle.

As @x3ns says in his/her comment you will also need to change the DatabaseManager code like this

class DatabaseManager
    {
        private $servername = "localhost";
        private $username = "root";
        private $password = "";
        private $dbname = "sokodatabase";

        public  $dbc;    //<-- change here

So that you can access that property from outside the object itself.

This is a quick fix but to be honest you would be better stopping and reading @x3ns's answer and applying most if not all of his/her suggestion.

Although I would like to add one more.

It is very bad practice to generate output directly from a class method as you have in public function SelectHighScores()

Directly echoing from a method totally destroys the ability to subclass and amend the activity of that method. It is far better to generate the output into a variable and return that variable. Then if I want to subclass your method I have the option of amending its result in some way if I need to.

Answer 3

Try replace:

@mysqli_query($this, $query);

With:

@mysqli_query($this->dbc, $query);