textarea中的輸入將不會在mysql表中更新

我創建了一個表單來更新我網站上的橫幅信息。除了輸入到名爲「desc」的「textarea」中的輸入外，一切似乎都會更新。代碼看起來不錯，它讓我瘋狂。textarea中的輸入將不會在mysql表中更新

在此先感謝。

<html> 
<body> 



<form action="aupdate.php" method="POST" enctype="multipart/form-data"> 

    Your or your company's name:<br> 
    <input type="text" name="com" size="60"><br> 


    URL:<br> 
    <input type="text" name="url" size="80"><br> 


    Please enter the username that you will use to update your advertisement info:<br> 
    <input type="text" name="user" size="80"><br> 

    Please enter the password that you will use to update your advertisement info:<br> 
    <input type="text" name="pass" size="80"><br> 

    <br> 
    <br> 


<br> 
    File:<br> 
    <input type="file" name="image"> 

      advertisement description:<br> 

<textarea name="desc" id="desc" cols="35" rows="5" ></textarea> 

     <input type="submit" value="update your ad!"> 


    </form> 

<?php 

//connect to database 
require("connect.php"); 

//get user made username 
$user = $_POST['user']; 

//get user made password 
$pass = $_POST['pass']; 

//encrypt user made password 
$encpass = hash('sha256', $pass); 

//file properties 
$file = $_FILES['image']['tmp_name']; 

//initialize company name and description 
$com = $_POST['com']; 
$desc = $_POST['desc']; 
$url = $_POST['url']; 




//check to see if coupon code and other essential info entered 
if (!$user || !$pass) 
{ 
    echo "Please enter updated info with username and password."; 
} 
else 
{ 

//retrieve data from password table 
$query = mysql_query ("SELECT * FROM apartment WHERE pass = '$encpass' "); 

//get number of rows in table 
$numrows = mysql_num_rows ($query); 

//check if code is right or exists 
if ($numrows !=0) 
{ 

    // code to login 
    while ($row = mysql_fetch_assoc ($query)) 
    { 
     //retrieve code from database to match with the code that was put into field 
     $dbuser = $row['user']; 
     $dbpass = $row['pass']; 
    } 

    //check to see if they match 
    if ($user == $dbuser && $encpass == $dbpass) 
    { 


    //check to see if a file has even been submitted 
    if (!$file) 
    { 

     echo "please upload image"; 
    } 
    else 
    { 
     //get image file attributes 
    $image = addslashes(file_get_contents ($_FILES['image']['tmp_name'])); 
    $image_name = addslashes($_FILES['image']['name']); 
    $image_size = addslashes(getimagesize($_FILES['image']['tmp_name'])); 

    //check if image file size is right 
    if ($image_size==FALSE) 
     echo "that's not an image."; 
    else 
    { 


mysql_query ("UPDATE apartment SET desc = '$desc' WHERE user ='$user'"); 
mysql_query ("UPDATE apartment SET name = '$image_name' WHERE user ='$user'"); 
mysql_query ("UPDATE apartment SET com = '$com' WHERE user ='$user'"); 
mysql_query ("UPDATE apartment SET url = '$url' WHERE user ='$user'"); 
mysql_query ("UPDATE apartment SET image = '$image' WHERE user ='$user'"); 


      echo "advertisement successfully updated!"; 



    } 
    } 


} 
else 


    echo "Incorrect username or password."; 
} 
else 



    echo "Incorrect username or password."; 

} 

?> 
</body> 
</html>

來源

2011-04-20 user701510

'die（$ desc）'查詢前檢查。 – 2011-04-20 06:48:08

或'die（mysql_error（））;'在desc查詢後檢查數據庫。請至少在插入數據庫之前檢查注入的變量，否則會非常危險 – Dormouse 2011-04-20 06:52:11

稍微不相關的一點：可以使用以下命令將您的五個查詢合併爲一個：mysql_query（「UPDATE apartment SET desc =' $ desc'，name ='$ image_name'，com ='$ com'，url ='$ url'，image ='$ image'WHERE user ='$ user'「）;'。 – Nick 2011-04-20 06:52:27

遞減的mysql reserved word括在反引號

和逃避用戶輸入與mysql_real_escape_string

$desc=mysql_real_escape_string($desc); 
    mysql_query ("UPDATE apartment SET `desc` = '$desc' WHERE user ='$user'");

你也可以提高你的更新查詢使用逗號來更新詢問分開場1次更新

mysql_query ("UPDATE apartment SET `desc` = '$desc',url='$url' WHERE user ='$user'");

來源

2011-04-20 06:50:43

爲什麼這是「desc」的情況，而不是正在更新的其他變量？ – user701510 2011-04-20 06:56:28

@user：因爲「desc」是mysql保留字，如果你使用保留字作爲列名mysql拋出錯誤信息。如果你把這個保留字反引號，一切都很好。這不僅是「desc」。如果您使用此http://dev.mysql.com/doc/refman/5.1/en/reserved-words.html列表中的任何保留字，則會拋出錯誤 – 2011-04-20 06:58:42

@user：您還應該使用'mysql_real_escape_string'否則你會遇到另一個問題。如果你把這個文本放在你的textarea中，你會明白我在說什麼 – 2011-04-20 07:01:20

textarea中的輸入將不會在mysql表中更新

回答

相關問題