使用ajax的数据库更新不起作用[关闭]

Question

Why this does't work?

<form id='formprofile' autocomplete='off'>
    <input type='text' name='name' value='<?php echo $row['name'];?>'>
    <input type='text' name='sname' value='<?php echo $row['sname'];?>'>
    <button type='button' id='btnsave'>Save</button>
</form>

javascript

$('#btnsave').click(function(){
$.ajax({
    url: 'profilesave.php',
    type: 'post',
    data: $('#formprofile').serialize(),
    success: function(data) {
        if (data =='empty'){
            alert ('something is missing!');
        }
        else{
            alert ('profile saved');
            location.href = 'index.php';
        }
    }
  });
});

profilesave.php

extract($_POST);

if ($name == ''){
    echo ('empty');
    exit();
}

try {
   $stmt = $db->prepare('UPDATE members SET name = :name, sname = :sname WHERE user = :"' . $user . '"');
   $stmt->execute(array(
    ":name" => $name,
    ":sname" => $sname
   ));
}
catch(PDOException $e) {
   echo $e->getMessage();
}

Database is not updated.
Variable $user is tested, it exists and have a propper value.

Database is not updated.
Variable $user is tested, it exists and have a propper value.

Answer 1

Assuming there is probably more content of profilesave.php ( ie: the database include and other variables such as $user ) then you should probably construct the prepared statement like this rather than embedding the value directly. You can test if the statement is created successfully before trying to execute it.

try{

    $name = !empty( $_POST['name'] ) ? $_POST['name'] : false;
    $sname = !empty( $_POST['sname'] ) ? $_POST['sname'] : false;

    if( $name && $sname ){
        $stmt = $db->prepare( 'UPDATE members SET name = :name, sname = :sname WHERE user = :user' );
        if( $stmt ){
            $stmt->execute( array(
                    ':name'     =>  $name,
                    ':sname'    =>  $sname,
                    ':user'     =>  $user
                )
            );
        } else {
            echo 'Prepared statement failed';
        }
    }
} catch( PDOException $e ){
    echo $e->getMessage();
}