PHP脚本未更新mysql表

Question

this script is simply not working... can anyone tell me what I'm doing wrong?

$id = $_POST['id'];
$name = $_POST['name'];
$date = $_POST['date'];
$shortdesc = $_POST['shortdesc'];
$link = $_POST['link'];
$target = $_POST['target'];
$sort = $_POST['sort'];
$html = $_POST['html'];

    include('appvars.php');

    $query = "UPDATE insight SET name='".$name."' AND SET date='". $date . "' AND SET html='" . $html . "' AND SET shortdesc='" . $shortdesc . "' AND SET link='" . $link . "' AND SET target='" . $target . "' AND SET sort='" . $sort . "' WHERE id='" . $id . "'";

    mysqli_query($dbc, $query);

Answer 1

You aren't escaping your values so you are vulnerable to SQL injection and also construction of invalid statements. For example, if any of your input strings contain an apostrophe then it could cause your code to fail.

Have a look at prepared statements that will make it much easier to construct your queries with parameters .

In your query you will also need to use commas instead of AND SET .

$query = "UPDATE insight SET name='foo', date='2012-12-10' WHERE id=42";

The syntax for UPDATE is described in the MySQL documentation:

• UPDATE syntax

Answer 2

这样使用

$query = "UPDATE insight SET name='".$name."' ,date='". $date . "' ,html='" . $html . "' ,shortdesc='" . $shortdesc . "' ,link='" . $link . "' ,target='" . $target . "' ,sort='" . $sort . "' WHERE id='" . $id . "'";

Answer 3

Its working ... check now

 $id = $_POST['id'];
    $name = $_POST['name'];
    $date = $_POST['date'];
    $shortdesc = $_POST['shortdesc'];
    $link = $_POST['link'];
    $target = $_POST['target'];
    $sort = $_POST['sort'];
    $html = $_POST['html'];

        include('appvars.php');

       $query = "UPDATE insight SET name='".$name."' ,date='". $date . "' ,html='" . $html . "' ,shortdesc='" . $shortdesc . "' ,link='" . $link . "' ,target='" . $target . "' ,sort='" . $sort . "' WHERE id='" . $id . "'";



        mysqli_query($dbc, $query);

Answer 4

I aint a pro at mysql, but a try.

I guess id is an integer. So, dont quote it.

Try this,

$query = "UPDATE insight SET name='".$name."' , date='". $date . "' , html='" . $html . "' , shortdesc='" . $shortdesc . "' , link='" . $link . "' , target='" . $target . "' , sort='" . $sort . "' WHERE id=". $id ;

Answer 5

我认为SQL语法不正确，可以这样使用它： UPDATE tablename SET rowname = value , ....