为什么我收到错误“'字段列表'中的未知列'存款'”

Question

I have created a simple HTML form for submitting an amount of money that should be deposited into an account. The form consists of a number input and a submit button.

When I press the submit button after inputting 10 in the input box I get this following error message:

Error updating record: Unknown column 'deposit' in 'field list'

I don't have such a column in my table as can be seen on the following image:

Welcome to the Bank! <br><br>
<table bgcolor="orange" border="1" cellspacing="0" cellpadding="50">

<tr><td>
<form action="" method='post'><b>Amount of money you want to deposit:</b><br><br>
<input type='number'><input name ='deposit' type='submit' value='deposit'></td></form>

<?php include 'db.php';
if (isset($_POST['deposit']))
{
    $deposit = $_POST['deposit'];
    
   $sql = "UPDATE bank SET bank = bank + $deposit, cash_on_hand = cash_on_hand - $deposit WHERE id=1";
   
   if ($conn->query($sql) === TRUE)
   {
     echo "Record updated successfully"; /*Money Deposited successfully!*/
   }
   else
   {
     echo "Error updating record: " . $conn->error;
   }
   $conn-> close();
}
?>

Answer 1

You have two problems with this code. The biggest one is that you have SQL injection. This is the reason why you get that error message.

You should never ever inject variables directly into SQL. This will break your SQL and cause errors which can even be abused by attackers. When you submit the form by pressing on the button the value of the button is sent to PHP. This value is then injected into SQL.

// The value comes from <input name ='deposit' type='submit' value='deposit'>
$deposit = $_POST['deposit'];
$sql = "UPDATE bank SET bank = bank + $deposit, cash_on_hand = cash_on_hand - $deposit WHERE id=1";
// this becomes an invalid query
$sql = "UPDATE bank SET bank = bank + deposit, cash_on_hand = cash_on_hand - deposit WHERE id=1";

Always use prepared statements with parameter binding.

include 'db.php';
if (isset($_POST['deposit'])) {
    $deposit = $_POST['deposit'];

    $stmt = $conn->prepare('UPDATE bank SET bank = bank + ?, cash_on_hand = cash_on_hand - ? WHERE id=1');
    $stmt->bind_param('ss', $deposit, $deposit); //bind the same variable twice for the two placeholders
    $stmt->execute();
}

Your second problem is the broken HTML form. Only <input> s with name are submitted to the server. The submit button doesn't need a name, but the number input field does. When fixed it should look something like this:

<form action="" method='post'>
    <b>Amount of money you want to deposit:</b>
    <br><br>
    <input type='number' name='deposit'>
    <input type='submit'>
</form>

If you want to learn more about HTML forms there is a guide on MDN .

Answer 2

Change this:

<input type='number'><input name ='deposit' type='submit' value='deposit'>

to this:

<input type='number' name="deposit"/><input name='submit' type='submit' value='deposit'/>

The way you've got it now, it sends the word "deposit" to your server, because that's the value of the button (which is the field which has the name="deposit" . Meanwhile, your number field doesn't have a name at all, and therefore doesn't get submitted with the form.

That's the root cause of your error because your SQL (due to the lack of proper parameterised queries) ends up as

UPDATE bank SET bank = bank + deposit, cash_on_hand = cash_on_hand - deposit WHERE id=1

And of course deposit , as you rightly say, isn't a column in your table.