插入MYSQL字符串PHP时，POST值变为空

Question

I am sending some values with AJAX POST to a PHP file: I know I am getting them because I can see the values sent in the console:

table=MENU&colid=MID&id=2&colname=STATUS&value=1

But for some strange reason when I insert them into the query string:

"UPDATE ".$_POST['table']." SET ".$_POST['colname']." = ".$_POST['value']." 
WHERE ".$_POST['colid']." = ".$_POST['id'];

Value is empty when value = 1!!!

UPDATE MENU SET STATUS = '' WHERE MID = '2'

I solved the problem by changing the variable name value to val, has anybody experienced something similar? is value a keyword or reserved word?

Any thoughts? Thanks

Answer 1

This SQL

UPDATE MENU SET STATUS = '' WHERE MID = '2'

doesn't actually reflect what you are doing in PHP. The line:

"UPDATE ".$_POST['table']." SET ".$_POST['colname']." = ".$_POST['value']." 
WHERE ".$_POST['colid']." = ".$_POST['id'];

otherwise should read:

"UPDATE ".$_POST['table']." SET ".$_POST['colname']." = '".$_POST['value']."' 
WHERE ".$_POST['colid']." = '".$_POST['id'] . "'";

mind the single quotes in your SQL statement which are missing in your PHP code.

Besides this I highly recommend to not send parts of SQL via AJAX from client to server as you are disclosing the internal structure of your database to everyone listening the traffic or just peeping into the data send by the browser.