doubo1871 2014-08-14 18:55
浏览 31

更新数据库中的字段，通过链接传递记录ID

I'm trying to write a code doing the following. I want to retrieve records from MySQL database. Each record contains (Course name, From, To, Credit hours, Details). I then want to add link for each record. When the link for a record is clicked, I want to redirect to the another page to update the field state to 'Yes' for that record.

Question: how can I update a specific record in database depending on the ID of record? In other words, how can I make each link pass the ID of its record to the update page so I can update it without write a specific ID?

My table contains these fields :

ID ,
Course_name,
From ,
To ,
Credit_hours ,
Detailes ,
state

First page

<!DOCTYPE html><html>

<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><link rel="stylesheet" type="text/css" href="mystyle.css">
<title>Training Courses Registration System </title>

</head>
<body>
<table style="width:786px; position:relative;
      margin-left:auto;
      margin-right:auto;">
<tr>
  <td> 
<img src="4.png" class="header">
 </td>

</tr>
<tr>
  <td><img src="2.png" class="bar">
<a href="home-ar.html"style="font-size:17px;position:absolute;top:163px;right:16px;z-index:5;lang=ar; text-decoration:none;">عربي</a>

<a href=" "style="font-size:17px;position:absolute;top:165px;right:55px;z-index:5;   text-decoration:none;">Sign out |</a>
 <a href="logout.php"class="l" >Profile  &nbsp; </a> 
<a href=" "class="l1">Available Courses  &nbsp; </a>
<a href=" "class="l5">Approve Courses</a>
<a href=" "class="l4">Statistic</a>
   </td>
</tr><tr>
<td>
<section class="b"><section class="f1">
<?php
$con=mysqli_connect("localhost","m","11","wafa");
// Check connection
if (mysqli_connect_errno()) {
  echo "Failed to connect to MySQL: " . mysqli_connect_error();
}

$result = mysqli_query($con,"SELECT * FROM internal");

?> 
<br>
<?php 
  while($row = mysqli_fetch_array($result)) {
     echo ' <details> 
<summary style="padding-left:33px;">' . $row['Course_name'] . "
</summary>";
 echo "<P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; From: &nbsp;".$row['From'] ."</p>" ;
 echo "<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;To: &nbsp;".$row['To'] . "</p>";
 echo "<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Credit Hours: &nbsp;".$row['Credit_hours']."</p>" ;
 echo "<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Detailes: &nbsp;". $row['Detailes'] ."</p>";
 echo "<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  <a style='color:#387c25;background-color:#a6d898;' href='in3.php?id=".$row['ID']."'>Accept</a>
</p>
 </details> <br>";
}

mysqli_close($con);
?>

 </section> 

</td></tr>
<tr><td><div class="footer">
<img src="3.png" class="footer"></div></section>

</td></tr>

</table>

</body>

</html>

Second page

<?php 

    $con=mysqli_connect("localhost","m","11","wafa");
// Check connection
if (mysqli_connect_errno()) {
  echo "Failed to connect to MySQL: " . mysqli_connect_error();
}

 if(isset($_GET['ID'])){
 $topic =$_GET['ID']; 
}

 $sql = ("UPDATE internal set state = u WHERE ID = $topic");


if (!mysqli_query($con,$sql)) {
  die('Error: ' . mysqli_error($con));
}
header("Location: internal.html");

mysqli_close($con);
?>
  • 写回答

1条回答 默认 最新

  • drjv5597 2014-08-14 19:00
    关注

    This is very wrong:

    $sql = ("UPDATE internal set state = u WHERE ID = $topic");
    • You have an sql injection problem;
    • You are using an undefined column / element u.

    It should be something like:

    $sql = "UPDATE internal set state = 'Yes' WHERE ID = ?";

    And then you bind your variable to the placeholder (the question mark), using a prepared statement.

    Note:

    • You should also have checks to see if the referenced record can be changed by the user, otherwise a user could edit arbitrary records by changing the url (or the post data, see the next point);
    • You should use POST instead of GET if you are going to modify information in the database.
    • You should add error handling to your database calls. The easiest way to do that in mysqli is to have it throw exceptions. To enable that, just put this at the top of your script: mysqli_report(MYSQLI_REPORT_STRICT);
    评论

报告相同问题？

悬赏问题

  • ¥20 完全没有学习过GAN，看了CSDN的一篇文章，里面有代码但是完全不知道如何操作
  • ¥15 使用ue5插件narrative时如何切换关卡也保存叙事任务记录
  • ¥20 软件测试决策法疑问求解答
  • ¥15 win11 23H2删除推荐的项目，支持注册表等
  • ¥15 matlab 用yalmip搭建模型，cplex求解，线性化处理的方法
  • ¥15 qt6.6.3 基于百度云的语音识别 不会改
  • ¥15 关于#目标检测#的问题：大概就是类似后台自动检测某下架商品的库存，在他监测到该商品上架并且可以购买的瞬间点击立即购买下单
  • ¥15 神经网络怎么把隐含层变量融合到损失函数中？
  • ¥15 lingo18勾选global solver求解使用的算法
  • ¥15 全部备份安卓app数据包括密码，可以复制到另一手机上运行