将数据从一个表插入到另一个表几乎可以正常工作

Question

I have two tables in my database, the first table called users and it contains: id, firstname, lastname, email, password, hash, active. 我的数据库中有两个表，第一个表称为users ，它包含：id，firstname，lastname，email，password，hash，active。

The second table called listing and it contains: user_id, user_email, listing_id, listing_title, list_description, listing _country, listing_city, listing_image. 第二个表称为清单，它包含：user_id，user_email，listing_id，listing_title，list_description，listing_country，listing_city，listing_image。

I want to make sure that when a user is logged in to the website and creates a new listing, the listing will be recognized by id and email. 我想确保当用户登录到网站并创建新列表时，该列表将由ID和电子邮件识别。

So basically i want to take the information from id and email that is on the users table and to insert it to the user_id and user_email columns on the listing table. 所以基本上我想从繁重的ID和电子邮件是在用户表中的信息，并把它插入到USER_ID和USER_EMAIL的房源表列。

And i did it, sort of. 我做到了，有点。

The problem is that if i'm logged in to the website and create a listing, the database shows the wrong user_id and user_email on the listing table. 问题是，如果我登录到网站并创建列表，则数据库在列表表上显示错误的user_id和user_email。 So for example: 因此，例如：

if i'm logged in as john@johndoe.com with the user id of 1 and i will create a new listing, when i go to the listing table i can see that the user_id and user_email are different and it pulls data from the latest row on the users table and not the user that is actually logged in. 如果我以john@johndoe.com的身份登录，用户ID为1，并且我将创建一个新列表，当我转到列表表时，我可以看到user_id和user_email不同，并且它从最新的列表中提取数据用户表上的行，而不是实际登录的用户。

Hope i made myself clear. 希望我能说清楚。

Here is the code: 这是代码：

this is a file called 'new-listing-functions.php' 这是一个名为“ new-listing-functions.php”的文件

<?php 
error_reporting(E_ALL);
require 'db.php';

if(!isset($_SESSION)) {
session_start();
}



$result = $mysqli->query("SELECT * FROM users");
$query = "SELECT id, email FROM users";


if ($result = $mysqli->query($query)) {
/* Fetch associative array */ 
while ($row = $result->fetch_assoc()) {
    $user_id_from_users_table = $row['id'];
    $user_email_from_users_table = $row['email'];
}
$result->free();
}


$_SESSION['id'] = $_POST['user_id'];
$_SESSION['email'] = $_POST['user_email'];
$_SESSION['listing_title'] = $_POST['listing_title'];
$_SESSION['listing_description'] = $_POST['listing_description'];
$_SESSION['listing_country'] = $_POST['listing_country'];
$_SESSION['listing_city'] = $_POST['listing_city'];
$_SESSION['listing_image'] = $_POST['listing_image'];


$listing_title = $mysqli->escape_string($_POST['listing_title']);
$listing_description = $mysqli>escape_string($_POST['listing_description']);
$listing_country = $mysqli->escape_string($_POST['listing_country']);
$listing_city = $mysqli->escape_string($_POST['listing_city']);
$listing_image = $mysqli->escape_string($_POST['listing_image']);



$sql = "INSERT INTO listing (user_id, user_email, listing_title, 
listing_description, listing_country, listing_city, listing_image)".
"VALUES('$user_id_from_users_table','$user_email_from_users_table',
'$listing_title', '$listing_description', '$listing_country', 
'$listing_city', '$listing_image')";




    if($mysqli->query($sql)) {
    $_SESSION['message'] = "Thank you for creating a listing " 
    .$_SESSION['firstname'];
    //header("location: home.php"); 
}



?>

And this is the code from the page with the form ('new-listing.php'): 这是页面中具有以下形式的代码（“ new-listing.php”）：

<?php 

require 'db.php';
session_start();


if(!$_SESSION['logged_in']) {
header("location: home.php");
}

require 'head.php';


?>

<?php 

if($_SERVER['REQUREST_METHOD'] = 'POST') {
if(isset($_POST['post_listing'])) {
    require 'new-listing-functions.php';
}
}


?>



<body id="new-listing">



<div class="new-listing-container">
    <form action="#" method="post">
        <input type="hidden" name="user_id">
        <input type="hidden" name="user_email">
        <input type="text" name="listing_title" placeholder="Listing Title">
<br>
        <textarea name="listing_description" id="" cols="30" rows="20" placeholder="Listing Description"></textarea>
        <input type="text" name="listing_country" placeholder="Country"><br>
        <input type="text" name="listing_city" placeholder="City"><br>
        <input type="file" name="listing_image""><br>
        <button name="post_listing">Proceed</button>
    </form>
</div><!-- new-listing-container -->

</body>
</html>

Thanks in advance for every help! 在此先感谢您的帮助！

Answer 1

Firstly, you should think about using prepared statements (look up mysqli::prepare or pdo ) instead of trying to sanitise and escape input. 首先，您应该考虑使用准备好的语句（查找mysqli::prepare或pdo ），而不是尝试清理和转义输入。

That aside, in your insert you are using $user_id_from_users_table and $user_email_from_users_table to populate your listing details. 除此之外，在insert您还使用$user_id_from_users_table和$user_email_from_users_table填充列表详细信息。

Based on your code, you should be using $_SESSION['id'] and $_SESSION['email'] instead, although these need sanitising or you need to switch to prepared statements before you put raw post data in an INSERT 根据您的代码，您应该改用$_SESSION['id']和$_SESSION['email'] ，尽管这些需要清理，或者您需要在将原始发布数据放入INSERT之前切换到准备好的语句。

This is because the $_user_*_from_users_table values look like they are literally the last obtained value from your users table: 这是因为$_user_*_from_users_table值看起来确实是从用户表中最后获得的值：

$result = $mysqli->query("SELECT * FROM users");
$query = "SELECT id, email FROM users";


if ($result = $mysqli->query($query)) {
/* Fetch associative array */ 
while ($row = $result->fetch_assoc()) {
    $user_id_from_users_table = $row['id'];
    $user_email_from_users_table = $row['email'];
}
$result->free();
}

That being said, I'm a bit confused as to what this is supposed to be achieving, or why you expect this to be any sort of session specific data? 话虽这么说，我对应该实现的目标还是感到困惑，或者为什么您期望它是任何特定于会话的数据？

Answer 2

Right at the start of your code you are selecting all the data from the users table and then looping through it, so your end result is the last entry. 在代码的开头，您正在从users表中选择所有数据，然后在其中循环遍历，因此最终结果是最后一个条目。

You need to sanitize the user entered email and user id and then use the WHERE parameter in your SELECT query to only fetch the row WHERE id = $id and email = $email 您需要清理用户输入的电子邮件和用户ID，然后在SELECT查询中使用WHERE参数仅获取WHERE id = $ id和email = $ email行

将数据从一个表插入到另一个表几乎可以正常工作

问题描述

2 个解决方案

解决方案1
0 2017-10-05 22:43:14

解决方案2
0 2017-10-05 23:21:12

将数据从一个表插入到另一个表几乎可以正常工作

问题描述

2 个解决方案

解决方案1 0 2017-10-05 22:43:14

解决方案2 0 2017-10-05 23:21:12

解决方案1
0 2017-10-05 22:43:14

解决方案2
0 2017-10-05 23:21:12