新闻脚本插入新闻数据，但不编辑新闻

Question

So I've got this code working so it can insert news into it's table, but the problem is the editing news afterwards if need be.

I've been trying different ways, but it seems to not be working full stop.

<? 
if(!$id)
echo("Please choose a page to edit..");
elseif($id==edit)
{
$select = mysql_query("select * from news where newsid = '$id'");
$article = mysql_fetch_array($select);
?>
<form action="edit-news.php?id=edited" method="post">
    Title:<br />
    <input name="readuser" type="text" value="<? echo("$article[title]");?>" size="70" />
Article Content:<br />
<textarea name="pageuser" cols="40" rows="6"><? echo("$article[text1]");?></textarea>
    <br />
    <br />
    <input type="submit" value="Update article" />
</form>
<?
}
elseif($page==edited)
{
$text1 = $_POST[pageuser];
$title = $_POST[readuser];
$updateit = mysql_query("update news set text1 = '$text1' AND title = '$title' where newsid = $id");
echo("Article updated");
}
?>

I get no error messages when visiting the page anymore (thankfully!!!) but it's just not editing the articles.

Answer 1

Assign a value to your text inputs and textareas so that they will display the article for editing:

<input name="title" size="40" maxlength="255" value="<?php echo htmlspecialchars($title); ?>">

<textarea name="text1"  rows="7" cols="30"><?php echo htmlspecialchars($text1); ?></textarea>

<textarea name="text2" rows="7" cols="30"><?php echo htmlspecialchars($text2); ?></textarea>

Also change <?php echo $PHP_SELF ?> to:

<?php echo htmlspecialchars($_SERVER['PHP_SELF']); ?>

---

Side note: mysql_* is deprecated, use MySQLi or PDO with prepared statements. Your query is vulnerable to SQL Injection. A quick fix would be:

 mysql_query("SELECT * FROM news WHERE newsid='" . (int)$_GET['newsid'] . "'",$connect);

Also mysql_real_escape_string() is better than mysql_escape_string() because the latter doesn't respect the character set. Neither are better than a prepared statement though.

Answer 2

尝试这个：

UPDATE news SET title = '$title', dtime = NOW(), text1 = '$text1', text2 = '$text2' WHERE newsid = '$newsid'