如何通过 PHP 更新 MySQL 表上的数据

Question

我似乎无法if(isset($_POST['schedule']))通过单击表单输入按钮来触发条件。如何$schedule_one使用以下代码更新变量？

    if(isset($_POST['login'])){

    $password=$_POST['password'];

    $email=$_POST['email'];

    $ret= mysqli_query($con,"SELECT * FROM maid_marketplace_users WHERE email='$email' and password='$password'");

    $num=mysqli_fetch_array($ret);

    $nomee = $num['full_name'];

    $schedOne = $num['schedule_one'];

    echo "<p align=center>You are entitled to <b>%10 off</b> for the next <b>12 months.</b></p> ";

?>       

     <div class="uk-child-width-expand@s uk-text-center" uk-grid>

           <center> <div class="uk-card uk-card-default uk-card-body">Welcome <b>

            <?php

            echo "<br>";

            if (is_null($schedule_one)){

                echo "You don't have any maid services scheduled";

                if(isset($_POST['schedule']))

                {

                    $id = $_SESSION['id'];

                    $schedule_one = $_POST['schedule_one'];

                    $sql=mysqli_query($con,"UPDATE maid_marketplace_users Set schedule_one='$schedule_one' WHERE id='$id'");

                    echo "<script>alert('$id Succes! your next schedule is on $schedule_one');</script>";

                    

                }

            }

            else

            {

                $schedule_one =  $_POST['schedule_one'];

                echo "Your next schedule is at $schedule_one";

            }

注意：我知道你不应该直接将密码添加到 Mysql 数据库中，完成后我将对其进行加密。

Answer 1

您不能拥有if(isset($_POST['schedule']))另一个if(isset($_POST['login']))条件语句的内部。你必须像这样将它移出第一个条件；if(isset($_POST['login'])){&nbsp;....}然后添加另一个条件 if 语句if(isset($_POST['schedule'])){&nbsp;....}其中一个 if 语句必须在开始另一个 if 语句之前完成。

Answer 2

很高兴您知道自己正在创建安全漏洞。您需要做的一件事是不要使 SQL 更新在逻辑上无法访问。在此：&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; echo "You don't have any maid services scheduled";&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; die();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if(isset($_POST['schedule']))&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $id = $_SESSION['id'];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $schedule_one = $_POST['schedule_one'];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $sql=mysqli_query($con,"UPDATE maid_marketplace_users Set schedule_one='$schedule_one' WHERE id='$id'");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; echo "<script>alert('$id Succes! your next schedule is on $schedule_one');</script>";&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }die()在到达 SQL 更新之前，它总是会中断您的代码。