php - MySQL 数据库更新仅使用数字

Question

我的更新表单脚本仅在我使用数字时有效，但如果我尝试使用任何文字，它就无效。我需要帮助，谢谢!

<?php
if(isset($_POST['teams'])){
  $home_team = $_POST['home_team'];
  $visitor_team = $_POST['visitor_team'];
  $sql = mysql_query("UPDATE table1 
SET home_team = $home_team, visitor_team = $visitor_team
WHERE active = 1") ;
  $retval = mysql_query( $sql, $conn );
  if(! $retval ){ 
die("<p>Error! Could not update team names. Click return button.</p>");
}
echo "<p>Team names set successfully!</p>";
mysql_close($conn);
} 
?>

Answer 1

尝试在您的查询中使用 ''，

$sql = mysql_query("UPDATE table1 SET 
            home_team = '".mysql_real_escape_string($home_team)."', 
            visitor_team = '".mysql_real_escape_string($visitor_team)."'
       WHERE active = '1'") ;

同时添加 mysql_real_escape_string() 来防止 SQL Enjection..