php - 从表单输入更新用户详细信息

Question

尝试使用表单更新登录用户的详细信息。页面加载时，详细信息已经存在于表单中，因此如果用户想要更改他们的手机号码，例如，他们可以删除当前号码，插入新号码并单击更新。

当我单击更新“‘where 子句’中的未知列‘Adrian93’”时，我收到此消息，Adrian93 是用户名

<?php
require('dbConnection.php');
require('checklogin.php');

if(isset($_POST['update']))
{
    $firstName = $_POST['firstName'];
    $lastName = $_POST['lastName'];
    $DOB = $_POST['dob'];
    $natInsNo = $_POST['natInsNo'];
    $address = $_POST['address'];
    $email = $_POST['email'];
    $mobile = $_POST['mobile'];
    $password = $_POST['password'];

    $query = "UPDATE users SET firstName='$firstName', lastName='$lastName', DOB='$DOB', natInsNo='$natInsNo', address='$address', email='$email', mobile='$mobile', password='$password' WHERE username = {$_SESSION['username']}";

    $results = mysqli_query($conn, $query) or die (mysqli_error($conn));

}



?>

Answer 1

Ralphs 评论“可能与你的尖括号有关。我在查询之前设置 $username = $_SESSION['username'] 然后只需执行 WHERE username='$username' 还要小心 SQL注入(inject)，我会在您的情况下使用准备好的语句，因为您正在获取表单输入并将它们直接放入查询中”解决了查询。现在运行没有任何错误。

<?php
require('checklogin.php');

if(isset($_POST['update']))
{
    $firstName = $_POST['firstName'];
    $lastName = $_POST['lastName'];
    $DOB = $_POST['dob'];
    $natInsNo = $_POST['natInsNo'];
    $address = $_POST['address'];
    $email = $_POST['email'];
    $mobile = $_POST['mobile'];
    $password = $_POST['password'];
    $username = $_SESSION['username'];

    $query = "UPDATE users SET firstName='$firstName', lastName='$lastName', DOB='$DOB', natInsNo='$natInsNo', address='$address', email='$email', mobile='$mobile', password='$password' WHERE username = '$username'";

    $results = mysqli_query($conn, $query) or die (mysqli_error($conn));    
}
?>