php - 表单更新用户尚未更新的字段 - PHP 查询

Question

我的 PHP 查询需要一些帮助。我实质上是让用户有机会在登录后更新自己的详细信息。表单:

<div class="grid-2"> 
    <p><b>UPDATE MY DETAILS</b></p>
        <form action ="includes/update.inc.php" method ="post">
        <label>S.Name</label>
        <input name="update-surname" type="text" placeholder="Enter new surname...">
        <label>Address</label>
        <input name="update-houseno" type="text" placeholder="Enter house no' or name...">
        <input name="update-ln1" type="text" placeholder="1st Line of Address...">
        <input name="update-town" type="text" placeholder="Town...">
        <input name="update-county" type="text" placeholder="County...">
        <input name="update-postcode" type="text" placeholder="Postcode...">
        <label>Contact Number</label>
        <input name="update-number" type="text" placeholder="Contact Number...">
        <label>Email</label>
        <input name="update-email" type="text" placeholder="Email...">

        <input type="submit" name="update-details" value="Update">
    </form>
</div>

我目前拥有的 php 代码，如果用户未在框中输入任何内容，它会使用空白输入更新数据库(我不想发生这种情况)，如果没有输入，我不会想要触摸表中的那个字段。

    <?php
// Here we check whether the user got to this page by clicking the proper button.
if (isset($_POST['update-details'])) {

      require 'dbh.inc.php';

// We grab all the data which we passed from the signup form so we can use it later.
    $surname = $_POST['update-surname'];
    $houseno = $_POST['update-houseno'];
    $ln1 = $_POST['update-ln1'];
    $town = $_POST['update-town'];
    $county = $_POST['update-county'];
    $postcode = $_POST['update-postcode'];
    $email = $_POST['update-email'];
    $number = $_POST['update-number'];

      // We validate the updated email is correct if email has been updated. 
  if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    header("Location: ../after-login.php?error=invalidmail=");
    exit();
    }

    $query = "UPDATE `tblMember` SET `fldSName` = '$surname', `fldTelNum` = '$number', `fld1stLnAddress` = '$houseno', `fld2ndLnAddress` = '$ln1', `fld3rdLnAddress` = '$town', `fldCounty` = '$county', `fldPostcode` = '$postcode', `fldEmailAddress` = '$email' WHERE `tblMember`.`fldMemberID` = 1";


    $result = $conn->query($query) or die ("error");
}
?>

一旦加载了 php 表单，网页就会消失，并且不会停留在当前网页上。

所以需要做两件事，帮助正确查询并帮助页面变为空白而不停留在网页上。

请注意，我知道这很容易受到注入(inject)攻击，我只是想让它在物理上正常工作，然后再尝试了解如何执行准备好的语句。

谢谢!

Answer 1

您需要检查数据输入字段是否为非空/有效。

避免空白字段更新的步骤:

1) 取一个空数组

2) 检查每个发布的变量是否有效，如果有效则将其附加到数组。

3) 检查数组是否不为空

4) 如果它不为空，则触发 SQL。

<?php
// Here we check whether the user got to this page by clicking the proper button.
if (isset($_POST['update-details'])) {

      require 'dbh.inc.php';

// We grab all the data which we passed from the signup form so we can use it later.
    $ln1 = $_POST['update-surname'];
    $houseno = $_POST['update-houseno'];
    $ln1 = $_POST['update-ln1'];
    $town = $_POST['update-town'];
    $county = $_POST['update-county'];
    $postcode = $_POST['update-postcode'];
    $email = $_POST['update-email'];
    $number = $_POST['update-number'];

      // We validate the updated email is correct if email has been updated. 
  if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    header("Location: ../after-login.php?error=invalidmail=");
    exit();
    }

    $update = [];
    if (! empty($surname)) {
        $update['fldSName'] = "fldSName = '".$surname ."'";
    }

    if (! empty($number)) {
        $update['fldTelNum'] = "fldTelNum='".$number ."'";
    }

    if (! empty($houseno)) {
        $update['fld1stLnAddress'] = "fld1stLnAddress='".$houseno ."'";
    }

    if (! empty($ln1)) {
        $update['fld2ndLnAddress'] = "fld2ndLnAddress='".$ln1 ."'";
    }

    if (! empty($town)) {
        $update['fld3rdLnAddress'] = "fld3rdLnAddress='".$town ."'";
    }

    if (! empty($county)) {
        $update['fldCounty'] = "fldCounty='".$county ."'";
    }
    if (! empty($postcode)) {
        $update['fldPostcode'] = "fldPostcode='".$postcode ."'";
    }
    if (! empty($email)) {
        $update['fldEmailAddress'] = "fldEmailAddress='".$email ."'";
    }


    if (! empty($update)) {
        $query = "UPDATE `tblMember` SET ";
        $query .= implode(', ', $update);
        $query .= " WHERE `tblMember`.`fldMemberID` = 1";
        $result = $conn->query($query) or die ("error");
    }
}
?>

注意:

fldMemberID 似乎是硬编码的。