php - 如何使用php更新多个数据

Question

我是这里的新手，我遇到了一个问题，我自己找不到确切的解决方案...这就是...我需要建立一个系统来更新所有员工信息。通过这个系统，人力资源部的工作人员将输入所有员工的信息。我已经创建了此代码来更新员工信息，但它似乎无法满足我真正想要的功能....我只想按行更新，但是，它会更新数据库中的所有行...

<?php
session_start();
include ("includes/database.php");
include ("includes/security.php");
include ("includes/config.php");

$nama=$_SESSION["nama"];
$pwd=$_SESSION["status"];

$nama=$_POST["st_nama"];
$siri1=$_POST["st_siri"];
$siri2=$_POST["st_siri2"];
$siri3=$_POST["st_siri3"];
$jawatan=$_POST["st_jawatan"];
$gred=$_POST["st_gred"];
$gredh=$_POST["st_gredh"];
$gelaran=$_POST["st_gelaran"];
$elaun=$_POST["st_elaun"];
$id=$_GET["id"];

$dataPengguna2= mysql_query("SELECT * FROM tbl_rekod where id='$id'");


mysql_query("UPDATE tbl_rekod set st_nama='$nama', st_siri='$siri1', st_siri2='$siri2', st_siri3='$siri3', st_jawatan='$jawatan', st_gred='$gred', st_gredh='$gredh', st_gelaran='$gelaran', st_elaun='$elaun' WHERE id='$id'") or die (mysql_error());

$status = "REKOD BERJAYA DIKEMASKINI!<br/><a href = 'stafflogin.php'><strong>KEMBALI KE LAMAN UTAMA</strong></a>";



?>

Answer 1

这将有助于解决您的 SQL 注入(inject)问题，并且还可能解决更新 1 与多行问题。此方法使用 PHP 中的 PDO 库。您可以在 PHP 站点上查看有关使用 PDO 的更多信息。它取代了 PHP 版本中不再包含的 mysql_ 命令集。

// Below replaces the mysql_connect() so it requires db credentials filled in
try {
        $host   =   'hostname';
        $db     =   'databasename';
        $user   =   'username';
        $pass   =   'password';
        $con    =   new PDO("mysql:host=$host;dbname=$db",$user,$pass, array(PDO::ATTR_ERRMODE => PDO::ERRMODE_WARNING));
    }
// This replaces the die("error message") potion of a mysql_connect() set-up
catch (Exception $e) {
      $_errors['connect']['message']    =   $e->getMessage();
      $_errors['connect']['error_code'] =   $e->getCode();
    }

$nama       =   $_SESSION["nama"];
$pwd        =   $_SESSION["status"];

$nama       =   $_POST["st_nama"];
$siri1      =   $_POST["st_siri"];
$siri2      =   $_POST["st_siri2"];
$siri3      =   $_POST["st_siri3"];
$jawatan    =   $_POST["st_jawatan"];
$gred       =   $_POST["st_gred"];
$gredh      =   $_POST["st_gredh"];
$gelaran    =   $_POST["st_gelaran"];
$elaun      =   $_POST["st_elaun"];
$id         =   $_GET["id"];

// You should do just a preliminary check that the id is a numeric value
// No sense in continuing if someone tries to foil the natural
// order of your code
if(is_numeric($id)) {
        // The next 3 lines would be equivalent to the mysql_query("statement here")
        // as well as a more robust version of mysql_real_escape_string(). It does more,
        // but for sake of explanation it does that and more.
        $dataPengguna2  =   $con->prepare("SELECT * FROM tbl_rekod where id=:id");
        // Binding paramaters basically sanitizes the value being inserted into your query
        $dataPengguna2->bindParam(':id',$id);
        $dataPengguna2->execute();

        // There is no indication of what you are doing with the select above

        // Set up the update statement
        $query  =   $con->prepare("UPDATE tbl_rekod set st_nama=:st_nama, st_siri=:st_siri, st_siri2=:st_siri2, st_siri3=:st_siri3, st_jawatan=:st_jawatan, st_gred=:st_gred, st_gredh=:st_gredh, st_gelaran=:st_gelaran, st_elaun=:st_elaun WHERE id=:id");
        // Bind all the values to sanitize against injection
        // You could do a function that loops through an array of values,
        // but this is one way to do it manually
        $query->bindParam(':st_nama',$nama);
        $query->bindParam(':st_siri',$siri1);
        $query->bindParam(':st_siri2',$siri2);
        $query->bindParam(':st_siri3',$siri3);
        $query->bindParam(':st_jawatan',$jawatan);
        $query->bindParam(':st_gred',$gred);
        $query->bindParam(':st_gredh',$gredh);
        $query->bindParam(':st_gelaran',$gelaran);
        $query->bindParam(':st_elaun',$elaun);
        $query->bindParam(':id',$id);
        $query->execute();

        // Print out error info. There may be something of value here
        // that may help you figure out why it's trying to update all your rows
        // instead of just the one.
        print_r($query->errorInfo());

        $status = "REKOD BERJAYA DIKEMASKINI!<br/><a href = 'stafflogin.php'><strong>KEMBALI KE LAMAN UTAMA</strong></a>";
    } ?>