如何在 php-mysql 中记录页面的所有更新

Question

在我的项目中，我有一个产品添加页面，它有一个编辑选项。

添加的产品详细信息将转到 mysql 数据库中的产品 table。

我想记录所有的编辑，包括它编辑的时间和用户。

我通过将 table 产品的副本创建为 product_updated 来完成此操作。

每当编辑产品时，该产品的产品 table 值随时间和用户更新存储在 product_updated table 中。

然后产品 table 更新为新值。

我是在 php mvc 框架中完成的。我的模型具有以下功能。

这是可行的，但是当产品名称包含 ' 符号时它会显示一些错误。

正确的做法是什么？

function product_edit_save($id = 0,$user_id) {


  $query=  $this->db->query("SELECT * FROM product WHERE product_id = $id");
  $result = $this->db->fetch_object($query);

    foreach ($result as $row) {

      $this->db->query("INSERT INTO product_updated SET product_id=$row->product_id,product_code = '$row->product_code', product_name =' $row->product_name', product_category = $row->product_category, 
     product_subcategory = $row->product_subcategory, product_supplier = ' $row->product_supplier', product_generic = $row->product_generic, 
         product_manufacturer  =$row->product_manufacturer,product_image = '$row->product_image', product_combination = $row->product_combination, product_package =$row->product_package,
             product_desc = '$row->product_desc', product_type = '$row->product_type', product_division = '$row->product_division',
                 product_chemical_name='$row->product_chemical_name',product_updatetime=now(),product_update_user=$user_id,product_banned=$row->product_banned", true);

    }

    $validate_form = true;
    $validate_error = array();
    $return['status'] = false;
    $return['message'] = '';

    if ($_POST) {

        $code = isset($_POST['code']) ? $_POST['code'] : '';
        $name = isset($_POST['name']) ? $_POST['name'] : '';
        $category = isset($_POST['category']) ? $_POST['category'] : '';
        $sub_category = isset($_POST['sub_category']) ? $_POST['sub_category'] : '';
        $generic = isset($_POST['generic']) ? $_POST['generic'] : '';
        $manufacturer = isset($_POST['manufacturer']) ? $_POST['manufacturer'] : '';
        $combination = isset($_POST['combination']) ? $_POST['combination'] : '';
        $package = isset($_POST['package']) ? $_POST['package'] : '';
        $desc = isset($_POST['desc']) ? $_POST['desc'] : '';
        $type = isset($_POST['type']) ? $_POST['type'] : '';
        $division = isset($_POST['division']) ? $_POST['division'] : '';
        $chemicalname = isset($_POST['chemicalname']) ? $_POST['chemicalname'] : '';
        $ban = isset($_POST['ban']) ? $_POST['ban'] : 0;

        if (isset($_POST['supplier'])) {
            $supplier = $_POST['supplier'];
        } else {
            $supplier = array();
        }



        if ($code == "") {
            $validate_error[] = "Code";
            $validate_form = false;
        } else {
            $esc_id = $this->db->escape($id);
            $esc_code = $this->db->escape($code);

            if ($this->db->num_rows($this->db->query("SELECT product_code FROM product WHERE product_code = $esc_code AND product_id != $esc_id")) != 0) {
                $validate_error[] = "Code Duplication";
                $validate_form = false;
            }
        }

        if ($name == "") {
            $validate_error[] = "Name";
            $validate_form = false;
        }


        if ($category == "-1") {
            $validate_error[] = "Category";
            $validate_form = false;
        }


        if ($manufacturer == "-1") {
            $validate_error[] = "Manufacturer";
            $validate_form = false;
        }


        if ($validate_form) {

            $esc_filename = $this->db->escape('');
            $isimage = "";
            if (isset($_FILES['image']['name'])) {

                $this->library('upload');
                $image = $this->library['upload']->image($_FILES['image'], UPLOAD, '180');

                if ($image['status'] == 0) {
                    $validate_error[] = 'image ( ' . $image['message'] . ' )';
                    $validate_form = false;
                } else {
                    $esc_filename = $this->db->escape($image['filename']);
                    $isimage = ",product_image = $esc_filename";
                }
            } else {
                $isimage = "";
            }
        }



        if ($validate_form) {

            $esc_id = $this->db->escape($id);
            $sub_category = isset($_POST['sub_category']) ? $_POST['sub_category'] : '';
            $generic = isset($_POST['generic']) ? $_POST['generic'] : '';
            $manufacturer = isset($_POST['manufacturer']) ? $_POST['manufacturer'] : '';
            $combination = isset($_POST['combination']) ? $_POST['combination'] : '';
            $package = isset($_POST['package']) ? $_POST['package'] : '';
            $desc = isset($_POST['desc']) ? $_POST['desc'] : '';
            $type = isset($_POST['type']) ? $_POST['type'] : '';
            $division = isset($_POST['division']) ? $_POST['division'] : '';



            $esc_code = $this->db->escape($code);
            $esc_name = $this->db->escape(strtoupper($name));
            $esc_category = $this->db->escape($category);
            $esc_sub_category = $this->db->escape($sub_category);
            $esc_supplier = $this->db->escape(implode(",", $supplier));
            $esc_generic = $this->db->escape($generic);
            $esc_manufacturer = $this->db->escape($manufacturer);
            $esc_combination = $this->db->escape($combination);
            $esc_package = $this->db->escape($package);
            $esc_desc = $this->db->escape($desc);
            $esc_type = $this->db->escape(strtoupper($type));
            $esc_division = $this->db->escape(strtoupper($division));
            $esc_ban=$this->db->escape(strtoupper($ban));
            $esc_chemicalname = $this->db->escape($chemicalname);

            try {

                $this->db->transaction();

                $this->db->query("UPDATE product SET product_code = $esc_code, product_name = $esc_name, product_category = $esc_category,product_chemical_name=$esc_chemicalname, 
                product_subcategory = $esc_sub_category, product_supplier = $esc_supplier, product_generic = $esc_generic, 
                    product_manufacturer  = $esc_manufacturer, product_combination = $esc_combination, product_package = $esc_package, 
                        product_desc = $esc_desc $isimage,product_type = $esc_type, product_division = $esc_division,product_banned=$esc_ban WHERE product_id = $esc_id", true);

                $this->db->commit();

                $return['status'] = true;
                $return['message'] = "Successfully Updated";
                return $return;
            } catch (Exception $e) {

                $this->db->rollback();
                $return['message'] = "Failed to Update";
                return $return;
            }
        } else {

            $return['message'] = "Invalid Field " . implode(", ", $validate_error);
            return $return;
        }
    }
}

Answer 1

为了做到这一点，或者您应该遵循预防 SQL 注射 http://en.wikipedia.org/wiki/SQL_injection

的最佳实践

您可以使用准备好的语句（最佳选择）或至少使用 mysqli_real_escape_string 转义您在 SQL 查询中输入的数据：http://php.net/manual/en/mysqli.real-escape-string.php

像这样的查询

SELECT * FROM table_name WHERE column_name = 'test'data';

会变成这样

SELECT * FROM table_name WHERE column_name = 'test\'data';

你将不再收到错误。

Answer 2

mysql_real_escape_string() 已弃用。

使用 stripslashes() 清理变量并（可选）使用 addslashes() 在读取它们时将它们添加回来。

示例：

$supplier = stripslashes($_POST['supplier']);

作为旁注，不要使用isset()，使用!empty()。

if(!empty($your_variable)) { ... }

而不是

if(isset($your_variable)) { ... }

如何在 php-mysql 中记录页面的所有更新

How to log my all updates of a page in php-mysql

php

mysql

model-view-controller