SQL 创建代码以编辑用户时出现异常

Question

Can't figure out why I'm being thrown an exception for the following code. I'm trying to edit a user based on their email address, not their id.

                <?php

                if(isset($_POST['edit_user'])) {

                $user_email = $_POST['Email'];

                $query = "SELECT * FROM users WHERE user_email = '{$user_email}' ";

                $select_users_query = mysqli_query($connection, $query); 

                while($row = mysqli_fetch_assoc($select_users_query)) {
                $user_firstname = $row ['user_firstname'];
                $user_lastname = $row ['user_lastname'];         
                $user_email = $row ['user_email'];
                $user_password = $row ['user_password'];
                $user_role = $row ['user_role'];

                   }
             }

                if(isset($_POST['edit_user'])) {

                $user_firstname = $_POST['FirstName'];    
                $user_lastname = $_POST['LastName'];   
                $user_email = $_POST['Email'];   
                $user_password = $_POST['Password'];
                $user_role = $_POST['UserRole'];


                $query = "UPDATE users SET ";
                $query .="user_firstname = '{$user_firstname}', ";
                $query .="user_lastname = '{$user_lastname}', ";
                $query .="user_email = '{$user_email}', ";
                $query .="user_password = password_hash('{$user_password}', PASSWORD_BCRYPT, array('cost'=> 12)) ";
                $query .="user_role = '{$user_role}' ";

                $query .= "WHERE 'user_email' = '{$user_email}' "; 

                $edit_user_query = mysqli_query($connection, $query);

                   confirmQuery($edit_user_query);

                }

                    ?>

Exception: Fatal error: Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '> 12)) user_role = 'Student' WHERE 'user_email' = ''' at line 1 in Stack trace: #0 mysqli_query(Object(mysqli), 'UPDATE users SE...') #1 {main} thrown in on line 203.

Answer 1

You can't call PHP functions inside the SQL query. You need to call the function from PHP, then use the result in the query.

You also should use a prepared statement instead of substituting variables directly into the SQL.

And you shouldn't have quotes around the column name in WHERE user_email = . See When to use single quotes, double quotes, and backticks in MySQL

There's no need to set user_email , since you're setting it to the same value that it already has.

$password_hash = password_hash($user_password, PASSWORD_BCRYPT, array('cost'=> 12));
$query = "UPDATE users SET 
            user_firstname = ?,
            user_lastname = ?,
            user_password = ?
            user_role = ?
          WHERE user_email = ?"; 
$stmt = mysqli_prepare($connection, $query);
mysqli_stmt_bind_param($stmt, "sssss", $user_firstname, $user_lastname, $password_hash, $user_role, $user_email);
mysqli_stmt_execute($stmt);
$edit_user_query = mysqli_stmt_get_result($stmt);