PHP / Mysql條件語句

Question

我有一個簡單的頁面/數據庫設置，您可以在其中增加或減少人A或人B的積分。

我得到了一些幫助，把一些東西扔進自己的功能中來清理東西。 我是php和mysql的新手; 仔細閱讀我所了解的所有邏輯，我只是​​想不通如何完成它，就目前而言，任何按鈕都會增加一個要點； 我需要讓Subtract點按鈕工作。

我的數據庫是表'user'，其中包含點和名稱

這就是我所擁有的：

<?php
function print_r_dump( $val )
{
echo '<pre>';
print_r( $val );
echo '</pre>';
}

//if ( isset( $_POST ) || isset( $_POST['Add point'] ) )
if ( isset( $_POST ) )
{

//Prints what's in post
print_r_dump( $_POST );

$str = "select * from user where name = '";
$str .= $_POST['person'];
$str .= "'";

$link = mysql_connect('mysql.xxxxx.net', 'xxxxx', 'xxxxx');
mysql_select_db('xxxxx_points', $link);
$result = mysql_query( $str , $link);

$row = mysql_fetch_assoc($result) ;
$points = $row['points'];

$str = 'update user set points = '. ($points+1) . ' where name = \''. $_POST['person'] . '\'';
$result = mysql_query( $str , $link);
}




$link = mysql_connect('mysql.xxxxx.net', 'xxxxx', 'xxxxx');
mysql_select_db('xxxxx_points', $link);

$str = "SELECT points FROM user WHERE name='Person A'" ;
$str = "SELECT * FROM user ";
$result = mysql_query( $str , $link);


$results = array();
while ( $row = mysql_fetch_assoc($result) )
{
$results[ $row['name'] ] = $row['points'];
}

?>

Person A's count: <?php echo $results['Person A']; ?>
<br>


<form method="post" action="index.php">
<input type="submit" name="submit_button" value="Add point" />
<input type="submit" name="submit_button" value="Subtract point" />
<input type="hidden" name="person" value="Person A" />
</form>

<br>

Person B's count: <?php echo $results['Person B']; ?>
<br>

<form method="post" action="index.php">
<input type="submit" name="submit_button" value="Add point" />
<input type="submit" name="submit_button" value="Subtract point" />
<input type="hidden" name="person" value="Person B" />
</form>

<?

print_r_dump( $results  );

?>

Answer 1

有很多錯誤：

• 每次運行查詢時都不需要創建新鏈接。
• 這條線根本不安全：$ str。= $ _POST ['person']; 任何人都可以破解您的代碼。
• 您應該檢查結果（從mysql返回）是否有效。

我試着把它清理一下。 這里和那里可能沒有什么錯誤（我沒有測試），但是演示了我剛才所說的：

<?php
function print_r_dump( $val )
{
echo '<pre>';
print_r( $val );
echo '</pre>';
}
$link = mysql_connect('mysql.xxxxx.net', 'xxxxx', 'xxxxx');
mysql_select_db('xxxxx_points', $link);


if ( isset( $_POST ) )
{
$str = "select * from user where name = '";
$str .= $_POST['person'];
$str .= "'";

$result = mysql_query( $str , $link);

if($result) {
    $row = mysql_fetch_assoc($result) ;
    $points = $row['points'];
    if(condition for adding) { // probably if(isset($_POST[submit_button_add))
        $str = 'update user set points = '. ($points+1) . ' where name = \''. $_POST['person'] . '\'';
        $result = mysql_query( $str , $link);
    } else if(condition for subtracting){// probably if(isset($_POST[submit_button_sub))
        $str = 'update user set points = '. ($points-1) . ' where name = \''. $_POST['person'] . '\'';
        $result = mysql_query( $str , $link);
    }
    $str = "SELECT * FROM user WHERE 1";
    $result = mysql_query( $str , $link);
    if($result) {
        $results = array();
        while ( $row = mysql_fetch_assoc($result) )
        {
            $results[ $row['name'] ] = $row['points'];
        }
    }
}

?>

Person A's count: <?php echo $results['Person A']; ?>
<br>


<form method="post" action="index.php">
<input type="submit" name="submit_button_add" value="Add point" />
<input type="submit" name="submit_button_sub" value="Subtract point" />
<input type="hidden" name="person" value="Person A" />
</form>

<br>

Person B's count: <?php echo $results['Person B']; ?>
<br>

<form method="post" action="index.php">
<input type="submit" name="submit_button" value="Add point" />
<input type="submit" name="submit_button" value="Subtract point" />
<input type="hidden" name="person" value="Person B" />
</form>

Answer 2

看起來您也不一定需要第一個SQL查詢。 您可以在數據庫中使用當前值，並使其自動更新，例如，points字段是數字而不是字符串。 對於代碼的主要PHP部分，請嘗試此操作。

<?php
function print_r_dump( $val )
{
echo '<pre>';
print_r( $val );
echo '</pre>';
}

if ( isset( $_POST ) )
{

//Prints what's in post
print_r_dump( $_POST );

$link = mysql_connect('mysql.xxxxx.net', 'xxxxx', 'xxxxx');
mysql_select_db('xxxxx_points', $link);

$str = "";

    if ($_POST['submit_button']=='Add point')
    {
    $str = 'update user set points = points+1 where name = \''. $_POST['person'] . '\'';
    }
    else if ($_POST['submit_button']=='Subtract point')
    {
    $str = 'update user set points = points-1 where name = \''. $_POST['person'] . '\'';
    }
    if ($str)
    {
    $result = mysql_query( $str , $link);
    }
}

$str = "SELECT points FROM user WHERE name='Person A'" ;
$str = "SELECT * FROM user ";
$result = mysql_query( $str , $link);


$results = array();
while ( $row = mysql_fetch_assoc($result) )
{
$results[ $row['name'] ] = $row['points'];
}

?>