问：PostGreSQL如何更有效地在SQL命令中传递POST信息

Question

I have a page that brings up a users information and the fields can be modified and updated through a form. Except I'm having some issues with having my form update the database. When I change the update query by hardcoding it works perfectly fine. Except when I pass the value through POST it doesn't work at all.

   if (isset($_POST['new']))
    {
   $result1 = pg_query($db, 
    "UPDATE supplies.user SET 

        id = '$_POST[id_updated]',  
        name = '$_POST[name_updated]',  
        department = '$_POST[department_updated]',
        email = '$_POST[email_updated]',
        access = '$_POST[access_updated]'    

     where id = '$_POST[id_updated]'");
  if (!$result1)
 {
   echo "Update failed!!";
} else
{
     echo "Update successful;";
}

I did a vardump as an example early to see the values coming through and got the appropriate values but I'm surprised that I get an error that the update fails since technically the values are the same just not being hardcoded..

UPDATE supplies.user SET name = 'Drake Bell', department = 'bobdole',
 email = '[e-mail]', access = 'N'  where id = 1 

I also based the form on this link here for guidance since I couldn't find much about PostGres Online Guide

Answer 1

Try dumping the query after the interpolation should have happened and see what query you're sending to postgres.

Better yet, use a prepared statement and you don't have to do variable interpolation at all!