提交post echo 但不向数据库写入信息

Question

我在更新数据库中的信息时遇到问题。回显成功弹出，但数据库行保持空白 - 为什么？ PHP代码：

<?php

    if (isset($_POST['gender'])) {
        // Sanitize and validate the data passed in
        $gender = filter_input(INPUT_POST, 'gender', FILTER_SANITIZE_STRING);
        if ($stmt) {
            $stmt->bind_param('s', $gender);
            $stmt->execute();
            $stmt->store_result();

            if ($insert_stmt = $mysqli->prepare("INSERT INTO  members gender VALUE ?")) {
                $insert_stmt->bind_param('s', $gender);
            }
        }
        echo "<div class='notemarg'> Your gender has been submitted</div>";
    } 
?>

并输入表格：

<form action="" method="POST">
  <input type="radio" name="gender" value="male"> Male <br>
  <input type="radio" name="gender" value="female"> Female <br>
  <input type="submit" name="gender" value="Set gender" class="button">
</form>

我想用mysqli->prepare来防止SQL注入。

我用替代方法修复了它，其中有预定义的按钮输入。

<?php

    $servername = "";
    $username = "";
    $password = "";
    $dbname = "";

    // Create connection
    $conn = new mysqli($servername, $username, $password, $dbname);
    // Check connection
    if ($conn->connect_error) {
        die("Connection failed: " . $conn->connect_error);
    }
     if (isset($_POST['Female'])) {

     $gender = $_POST['Female'];
     $sql = "UPDATE members SET gender = '$gender' WHERE username = '".$_SESSION['username']."'"; 


    if ($conn->query($sql) === TRUE) {
        echo "<div class='notemarg'> Your gender has been submitted</div>";
    } else {
        echo "Error: " . $sql . "<br>" . $conn->error;
    }
    $conn->close();
}
    ?>

简单形式：

<form action="" method="POST">
 <input type="submit" name="Female" value="Female" class="button">
</form>

感谢所有想帮助我的人，尤其是 anant kumar singh。没有他的建议，我无法得到那个改变的想法。谢谢！

更新 #1

它只是弹出 echo "error"

<?php

if(isset($_POST['Female'])){

    $servername = "";
    $username = "";
    $password = "";
    $dbname = "";

    // Create connection
    $conn = new mysqli($servername, $username, $password, $dbname);
    // Check connection
    if ($conn->connect_error) {
        die("Connection failed: " . $conn->connect_error);
    }
     if (isset($_POST['Female'])) {

     $gender = $_POST['Female'];
     $stmt = $conn->prepare('UPDATE members
     SET gender = ?
     WHERE username = ?'); 
$stmt->bind_param('s', $_POST['Female']);
 $stmt->bind_param('s', $_SESSION['username']);

    if ($conn->prepare === TRUE) {
        echo "<font color='#00CC00'>Your gender has been updated.</font><p>";
    } else {
        echo "Error: " . $conn->prepare . "<br>" . $conn->error;
    }
    $conn->close();
}
}
?>

不知道哪里出了问题... 更新 #2

if(isset($_POST['Female'])){

    $servername = "";
    $username = "";
    $password = "";
    $dbname = "";

  // Create connection
    $conn = new mysqli($servername, $username, $password, $dbname);
    // Check connection
    if ($conn->connect_error) {
        die("Connection failed: " . $conn->connect_error);
    }
     if (isset($_POST['Female'])) {

     $gender = $_POST['Female'];
     $sql = "
     UPDATE members
     SET gender = ?
     WHERE username = ?
 ";
 $stmt = $mysqli->prepare($sql);
 $stmt->bind_param('s', $_POST['Female']);
 $stmt->bind_param('s', $_SESSION['username']);
 $stmt->execute();

    if ($mysqli->prepare($sql) === TRUE) {
        echo "<font color='#00CC00'>Your gender has been updated.</font><p>";
    } else {
        echo "Error: " . $conn->prepare . "<br>" . $conn->error;
    }
    $conn->close();
}
}

更新 #3

我还在代码中添加了一些注释所以

     <?php
    // I had here twice the ifisset here and
        if(isset($_POST['Female'])){

        $servername = "";
        $username = "";
        $password = "";
        $dbname = "";

       // Create connection
        $conn = new mysqli($servername, $username, $password, $dbname);
        // Check connection
        if ($conn->connect_error) {
            die("Connection failed: " . $conn->connect_error);
        }
    //here the second one so I deleted that ifisset here...
         $gender = $_POST['Female'];
         $sql = "
         UPDATE members
         SET gender = ?
         WHERE username = ?
     ";
     $stmt = $mysqli->prepare($sql);
     $stmt->bind_param('s', $_POST['Female']);
     $stmt->bind_param('s', $_SESSION['username']);
     $ok = $stmt->execute();

        if ($ok == TRUE) {
            echo "<font color='#00CC00'>Your gender has been updated.</font><p>";
        } else {
            echo "Error: " .$stmt->error; // This is the line that shows the error
        }
        $conn->close();
    }
?>

我不确定是什么问题...它在回显时弹出错误 "No data supplied for parameters in prepared statement"

Answer 1

在发布了一个带有巨大安全漏洞的答案后，值得花点时间来解决这个问题。有一种方法可以修复它，因此您可以使用字符串连接方法，但它通常不如参数化好。

您需要做的就是获取您的工作查询，并将其转换为参数化形式。像这样：

 // Expects valid $mysqli object here
 $sql = "
     UPDATE members
     SET gender = ?
     WHERE username = ?
 ";
 $stmt = $mysqli->prepare($sql);

 // ** As we discovered, the binding needs to happen in one
 // ** call, not across several
 $stmt->bind_param('ss', $_POST['Female'], $_SESSION['username']);
 $stmt->execute();

查看您的原始代码，似乎有两个问题：语句根本没有准备好（因此程序应该退出并出现致命错误）并且原始 SQL声明。

在您的新代码中，您缺少 execute() 调用。

提交post echo 但不向数据库写入信息

Submit post echo but does not write information in database

php

database

forms

mysqli