使用PHP將信息更新到MySQL數據庫

Question

在我的代碼中，我嘗試使用表單中可修改文本字段中的值更新數據庫。 但是，運行查詢時，它將擦除與用戶嘗試編輯的記錄相關的所有字段（將其變為“”）。 誰能看到為什么？

<?php
$dbuser = 'test';
$dbpass = 'test';
$host = '127.0.0.1';
$db = 'test';
mysql_connect($host, $dbuser, $dbpass) or die(mysql_error());
mysql_select_db($db) or die(mysql_error());

$result = mysql_query("SELECT * from characters");
$id = $_REQUEST['combo'];
while($row = mysql_fetch_array($result))
{
    if($id == $row['_Key'])
    {
        echo "<form action=\"webpagetests.php\" method=\'post\'>";
        echo "<strong>Player ID:</strong>    " . $row['_Key'] . "</br>";
        echo "<strong>Steam Name:</strong>   " . $row['_SteamName'] . "</br>";
        echo "<strong>Steam ID:</strong>     " . $row['_SteamID'] . "</br></br>";

        echo "Name: </br><input name = \"name\" type=\"text\" size=\"25\" value=\"" . $row['_Name'] . "\"></br></br>";
        echo "Cash: </br><input name = \"cash\" type=\"text\" size=\"25\" value=\"" . $row['_Cash'] . "\"></br></br>";
        echo "Flags: </br><input name = \"flags\" type=\"text\" size=\"25\" value=\"" . $row['_Flags'] . "\"></br></br>";
        echo "Gender:</br> <input name = \"gender\" type=\"text\" size=\"25\" value=\"" . $row['_Gender'] . "\"></br></br>";
        echo "Model:</br> <input name = \"model\" type=\"text\" size=\"50\" value=\"" . $row['_Model'] . "\"></br></br>";
        echo "Faction: </br><input name = \"faction\" type=\"text\" size=\"25\" value=\"" . $row['_Faction'] . "\"></br></br></br>";
        echo "Recognised Names: </br><input name = \"names\" type=\"text\" size=\"50\" value=\"" . $row['_RecognisedNames'] . "\"</br>";
        echo "<input name=\"submit2\" type=\"submit\" value=\"Update\" />";
        echo "</form>";
    }
}
if (isset($_POST['submit2'])) 
{
    //$name = mysql_real_escape_string(htmlspecialchars($_POST['name']));
    $name = "Test";
    $cash = (int)$_POST['cash'];
    $flags = mysql_real_escape_string(htmlspecialchars($_POST['flags']));
    $gender = mysql_real_escape_string(htmlspecialchars($_POST['gender']));
    $model = mysql_real_escape_string(htmlspecialchars($_POST['model']));
    $faction = mysql_real_escape_string(htmlspecialchars($_POST['faction']));
    $names = mysql_real_escape_string(htmlspecialchars($_POST['names']));

    mysql_query("UPDATE  `test`.`characters` SET  `_Name` =  '$name',
    `_Cash` =  '$cash',
    `_Model` =  '$model',
    `_Flags` =  '$flags',
    `_Gender` =  '$gender',
    `_Faction` =  '$faction',
    `_RecognisedNames` =  '$names' 
    WHERE  `characters`.`_Key` ='$id'") or die(mysql_error());
    echo '<META HTTP-EQUIV="Refresh" Content="0; URL=webpagetest.php">'; 
}?>

Answer 1

1）select語句中沒有where子句，因此整個表從DB轉移到PHP腳本。 加：

$id = mysql_real_escape_string($id);
$result = mysql_query("select * from characters where _Key = '$id'");

以提高性能和帶寬使用率。 更好的是，使用mysqli ，您可以在其中使用准備好的語句。

2）當表單返回時，我看不到$id設置在哪里，所以這也可能是一個問題。