为什么我的SQL查询不起作用

Question

My SQL query doesn't work (the one with "UPDATE...") MySQL doesn't return any error, and the UPDATE query doesn't update anything.

this is my code:

<?php
print_r($_POST);
try
{
    $bdd = new PDO('mysql:host=localhost;dbname=perso;charset=utf8', 'root', 'root');
}
catch (Exception $e)
{
    die('Erreur : ' . $e->getMessage());
}
$query = "SELECT * FROM money WHERE name='" . $_GET['name'] . "'";
foreach($bdd->query($query) as $val)
{
    $name = $val['name'];
    $balance = $val['balance'];
}
$balance = $balance + $_POST['money'];
echo $balance;
$query = "UPDATE money SET balance = " . $balance . " WHERE name = '" . $_GET['name'] . "'";
echo $query;
?>

Answer 1

The reason is because you don't execute your statement, add this line to your code and you should be good...

$bdd->query($query);

However, this is a really bad way to do things, you are open to SQL injection attacks because you are not preparing (escaping) your strings. The best way to do it is by using parameters, then binding them to a prepared statement, like this...

Setup your query, leaving data from users out, so anything after an = should be replaced by a ? , like this

$query = "SELECT * FROM money WHERE name=?";

Also, don't put quotes around the question mark, PDO will do this automatically when you bind your parameter.

Next, you need to prepare your statement, like this...

$preparedStatement = $bdd->prepare($query);

You can then bind your parameters to the statement. If you only have one, which in your case you do, you simply do it like this...

$preparedStatement->bindParam(1, $_GET['name']); //This is binding $_GET['name'] to the first question mark in the query, which is after name=.

If you have multiple parameters to bind, you simply need to replace the 1 with the position of the question mark, and repeat the same process for the amount of parameters you have.

You can also use iteration and arrays (using for and foreach loops) if you have a lot of parameters, to save yourself writing lines and lines of code.

Hope this helps!

EDIT

If you implement all of what I have recommended, your new code will look like this...

<?php
print_r($_POST);
try{
    $bdd = new PDO('mysql:host=localhost;dbname=perso;charset=utf8', 'root',     'root');
}
catch (Exception $e){
    die('Erreur : ' . $e->getMessage());
}

$query = "SELECT * FROM `money` WHERE `name`=?"; //Replacing the     concatenation with parameters.
$pStatement = $bdd->prepare($query); //Preparing your statement. This closes     your vulnrability to attack.
$pStatement->bindParam(1, $_GET['name']); //Binding $_GET['name']
$pStatement->execute(); //Execute the statement.

foreach($pStatement->fetchAll(PDO::FETCH_ASSOC) as $val){ //Fetching all     from the executed statement as an associative array.
    $name = $val['name'];
    $balance = $val['balance'];
}

$balance = $balance + $_POST['money'];
echo $balance;
$query = "UPDATE money SET balance = " . $balance . " WHERE name = '" .     $_GET['name'] . "'";
echo $query;
?>