mysql - 我在 SQL 消息中找不到解决方案。我想要一些建议

Question

我有一个网站 www.jazz.eu。 我在不同的服务器上用不同的域名将这个站点精确复制到另一个站点。新的是 www.vetur.nl。

一切正常(我的意思是类似于 jazz.eu)。除了购物车过程。 首先，当我看到购物车时，我总是排着一条空产品。我无法删除它。明白我的意思

http://www.vetur.nl/cart_empty_product_line.jpg

我遇到的下一个问题是，当我尝试刷新购物车或发送订单时，我收到此消息

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near
'sender_full_name='',sender_afm='',sender_doy='',sender_work='',sender_person='',' at line 1
query=update basket set selected_quantity=,sender_full_name='' ,sender_afm='',sender_doy='',sender_work='',sender_person='',sender_address='',sender_zip='',sender_tel='',sender_fax='', addresser_email='', additional='' where session_id = 'ihcvafpk3fgqh6jra1mrplgkr1' and id= 

我认为问题出在这个文件 process.php 中，但我找不到它。确切的文件在我的第一个站点 jazz.eu 中工作正常。似乎有问题的 process.php 代码如下。 谢谢，请原谅发帖中的任何错误。这是我第一次在这里发帖。

    function procMy_cart(){
        global $session, $form,$database,$mailer;

        $session_id = session_id();
        if ((isset($_POST['order'])) && ($_POST['order']==1)) {
            if (!eregi("[a-z\α-ω\!\"\£\$\%\^\&\*\(\)\-\+\{\}\:\;\'\@\~\#\\\|\<\>\?\/]", $_POST['update_quantity'][$i])) {
                        For ($i=0;$i<count($_POST['update_quantity']);$i++) {

                    if (!eregi("[a-z\α-ω\!\"\£\$\%\^\&\*\(\)\-\+\{\}\:\;\'\@\~\#\\\|\<\>\?\/]", $_POST['update_quantity'][$i])) {
                        //$update_db="update basket set selected_quantity=".$_POST['update_quantity'][$i].",addresser='".$_POST['addresser']."',addresser_tel='".$_POST['addresser_tel']."', addresser_email='".$_POST['addresser_email']."', additional='".$_POST['additional']."' where session_id = '$session_id' and id=".$_POST['update_id'][$i]."";
                        $update_db="update basket set selected_quantity=".$_POST['update_quantity'][$i].",sender_full_name='".$_POST['addresser']."',sender_afm='".$_POST['addresser_afm']."',sender_doy='".$_POST['addresser_doy']."',sender_work='".$_POST['addresser_work']."',sender_person='".$_POST['addresser_contact']."',sender_address='".$_POST['addresser_address']."',sender_zip='".$_POST['addresser_zip']."',sender_tel='".$_POST['addresser_tel']."',sender_fax='".$_POST['addresser_fax']."', addresser_email='".$_POST['addresser_email']."', additional='".$_POST['additional']."' where session_id = '$session_id' and id=".$_POST['update_id'][$i]."";
                        $result=$database->query($update_db);

                    } else {

                        //$update_db="update basket set selected_quantity=1,addresser='".$_POST['addresser']."',addresser_tel='".$_POST['addresser_tel']."',addresser_email='".$_POST['addresser_email']."', additional='".$_POST['additional']."' where session_id = '$session_id' and id=".$_POST['update_id'][$i]."";
                        $update_db="update basket set selected_quantity=1,sender_full_name='".$_POST['addresser']."',sender_afm='".$_POST['addresser_afm']."',sender_doy='".$_POST['addresser_doy']."',sender_work='".$_POST['addresser_work']."',sender_person='".$_POST['addresser_contact']."',sender_address='".$_POST['addresser_address']."',sender_zip='".$_POST['addresser_zip']."',sender_tel='".$_POST['addresser_tel']."',sender_fax='".$_POST['addresser_fax']."', addresser_email='".$_POST['addresser_email']."', additional='".$_POST['additional']."' where session_id = '$session_id' and id=".$_POST['update_id'][$i]."";
                        $result=$database->query($update_db);
                    }
                }
            }
//          $retval = $session->my_cart($_POST['addresser'], $_POST['addresser_doy'], $_POST['addresser_work'], $_POST['addresser_afm'], $_POST['addresser_address'], $_POST['addresser_zip'], $_POST['addresser_contact'], $_POST['addresser_email'], $_POST['addresser_tel'], $_POST['addresser_fax'], $_POST['additional']);
//          if ($retval) {
//               $_SESSION['send_order'] = true;
//              header("Location: my_cart2.php");//.$session->referrer);
//          } else {
//              $_SESSION['value_array'] = $_POST;
//              $_SESSION['error_array'] = $form->getErrorArray();
//              header("Location: my_cart2.php");//.$session->referrer);
//          }
        header("Location: order2.php");

        } else if ((isset($_POST['order'])) && ($_POST['order']!=1)) {
            if ((isset($_POST['refresh_basket'])) && ($_POST['refresh_basket']==1)) {
                For ($i=0;$i<count($_POST['update_quantity']);$i++) {
                    //echo $_POST['update_id'][$i];
                    if (!eregi("[a-z\α-ω\!\"\£\$\%\^\&\*\(\)\-\+\{\}\:\;\'\@\~\#\\\|\<\>\?\/]", $_POST['update_quantity'][$i])) {
                        //$update_db="update basket set selected_quantity=".$_POST['update_quantity'][$i].", addresser='".$_POST['addresser']."', addresser_tel='".$_POST['addresser_tel']."',  addresser_email='".$_POST['addresser_email']."', additional='".$_POST['additional']."' where session_id = '$session_id' and id=".$_POST['update_id'][$i]."";
                        $update_db="update basket set selected_quantity=".$_POST['update_quantity'][$i].",sender_full_name='".$_POST['addresser']."',sender_afm='".$_POST['addresser_afm']."',sender_doy='".$_POST['addresser_doy']."',sender_work='".$_POST['addresser_work']."',sender_person='".$_POST['addresser_contact']."',sender_address='".$_POST['addresser_address']."',sender_zip='".$_POST['addresser_zip']."',sender_tel='".$_POST['addresser_tel']."',sender_fax='".$_POST['addresser_fax']."', addresser_email='".$_POST['addresser_email']."', additional='".$_POST['additional']."' where session_id = '$session_id' and id=".$_POST['update_id'][$i]."";
                        $result=$database->query($update_db);

                    } else {
                        //$update_db="update basket set selected_quantity=1, addresser='".$_POST['addresser']."', addresser_tel='".$_POST['addresser_tel']."',  addresser_email='".$_POST['addresser_email']."', additional='".$_POST['additional']."' where session_id = '$session_id' and id=".$_POST['update_id'][$i]."";
                        $update_db="update basket set selected_quantity=1,sender_full_name='".$_POST['addresser']."',sender_afm='".$_POST['addresser_afm']."',sender_doy='".$_POST['addresser_doy']."',sender_work='".$_POST['addresser_work']."',sender_person='".$_POST['addresser_contact']."',sender_address='".$_POST['addresser_address']."',sender_zip='".$_POST['addresser_zip']."',sender_tel='".$_POST['addresser_tel']."',sender_fax='".$_POST['addresser_fax']."', addresser_email='".$_POST['addresser_email']."', additional='".$_POST['additional']."' where session_id = '$session_id' and id=".$_POST['update_id'][$i]."";
                        $result=$database->query($update_db);
                    }
                }
            }
            $_SESSION['value_array'] = $_POST;
            $_SESSION['error_array'] = $form->getErrorArray();
            header("Location: my_cart2.php");//.$session->referrer);
        }
    } // end cart

Answer 1

变量 $_POST['update_quantity'][$i] 没有值。如果您查看查询，您会注意到 set selected_quantity=,sender_full_name=''。您至少需要一组单引号或 null 分配给 selected_quantity。

您永远不应该将 _POST 数据直接分配给查询。始终以某种方式清理它以避免 SQL 注入(inject)攻击。您应该尽早将 $_POST['update_quantity'][$i] 分配给变量并执行一些逻辑以确保它具有有效值，如果没有，则阻止查询运行或添加默认值。