MySQL的语法错误

Question

<form action="editauthor.php" method="post"> 
    <label>Author Name:</label> 
    <input type="text" name="txtUser" value="<?=$name;?>" /><br /><br /> 
    <label>Email:</label> 
    <input type="text" name="txtEmail" value="<?=$email;?>" /><br /><br /> 
    <input type="hidden" name="id" value="<?=$id?>" /> <!-- use hidden to hide id for using, but not display, here id is not important --> 
    <input type="submit" value="Edit" name="submit" /> 
</form> 
<?php 
    if(isset($_POST['submit'])) { 
    $con = @mysql_connect("localhost","root",""); 
    mysql_select_db("jokes",$con); 

    $name = $_POST['txtUser']; 
    $email = $_POST['txtEmail']; 

    $sql = "UPDATE authors 
       SET name = '".$_POST['txtUser']."', 
        email = '".$_POST['txtEmail']."' 
      WHERE id = ".$_GET['id']""; 

    $result = @mysql_query($sql, $con) or die(mysql_error()); 
    if($result) { 
     echo "New Author has been edited successfully!"; 
    } else { 
     echo "Cannot update this kind of author into the database. ".mysql_error(); 
    } 
    } ?> 

...它产生以下错误：

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1

Answer 1

你缺少点这里WHERE id = ".$_GET['id']"";

Answer 2

在SQL语句结尾摆脱两个引号

$sql = "UPDATE authors SET name = '".$_POST['txtUser']."', email = '".$_POST['txtEmail']."' WHERE id = ".$_GET['id']; 

Answer 3

正确的答案已经发布，但让我给你一些建议。

在未来，尝试这样做：

$result = @mysql_query($sql, $con) or die($sql.'<hr>'.mysql_error()); 

那么你可以随时看到mysql的一句话给你的问题。如果你不知道为什么它会打扰你，请复制粘贴它，然后在你的phpMyAdmin中试用它。

祝您好运与您的项目：]

Answer 4

问题是，你正在使用$ _GET [“身份证”]，你的ID不是_GET方法及其在$ _ POST，所以您的查询就会有这样的事情

其中id = 后“=”因为没有价值$ _GET [“身份证”] 只是将其更改为$ _ POST

Answer 5

<?php 
    if(!empty($_POST)) 
    { 
     $con = @mysql_connect("localhost","root",""); 
     mysql_select_db("jokes",$con); 

     $name = $_POST['txtUser']; 
     $email = $_POST['txtEmail']; 
     $sql = "UPDATE authors SET name = '" . $_POST['txtUser'] . "', email = '" . $_POST['txtEmail'] . "' WHERE id = '" . $_GET['id'] ."'"; 

     $result = @mysql_query($sql, $con) or die(mysql_error()); 

     if($result) 
     { 
      echo "New Author has been edited successfully!"; 
     } 
     else 
     { 
      echo "Cannot update this kind of author into the database. " . mysql_error(); 
     } 

    } 
    else 
    { 
     $name = ''; 
     $email = ''; 
     $id = ''; 
    } 
?> 

<form action="./editauthor.php" method="post"> 
    <label>Author Name:</label> 
    <input type="text" name="txtUser" value="<?= $name ?>" /><br /><br /> 
    <label>Email:</label> 
    <input type="text" name="txtEmail" value="<?= $email ?>" /><br /><br /> 
    <input type="hidden" name="id" value="<?= $id ?>" /> <!-- use hidden to hide id for using, but not display, here id is not important --> 
    <input type="submit" value="Edit" name="submit" /> 
</form> 

Answer 6

最有可能的是造成了'一个语法错误，没有价值在txtUser或txtEmail字段。你的代码容易受到SQL注入攻击，现在注入“攻击”只是导致语法错误。

例如Miles O'Brien填写表单，让您的查询就会变成：

UPDATE authors 
... 
WHERE name='Miles O'Brien' 
        ^---syntax error here 

您真的需要去拜访http://www.bobby-tables.com，然后rejigger你的代码看起来像这样：

  SET name = '" . mysql_real_escape_string($_POST['txtUser']) . "', 
       email = '" . mysql_real_escape_string($_POST['txtEmail']) . "' 

Answer 7

用途：

$sql = sprintf("UPDATE AUTHORS 
        SET name = '%s', 
         email = '%s' 
       WHERE id = %d ", 
       mysql_real_escape_string($_POST['txtUser']), 
       mysql_real_escape_string($_POST['txtEmail']), 
       mysql_real_escape_string($_POST['id'])); 

它会保护你免受SQL injection attacks，并纠正你用来获得身份证的方法 - 表格是pos吨，只有一个请求将被提出。