PHP - 用户管理删除问题

Question

我正在开发自定义内容管理系统。我被指示做一些改变，而这正是我需要做的。我需要创建一个用户管理页面，允许管理员从数据库中删除（或禁用他的状态）用户。

这是我的用户管理页面：

<?php 
$query = 'SELECT author_id, author_email as Email, author_name as Name 
     FROM authors 
     ORDER BY Name 
     LIMIT 0, 30'; 

$result = mysql_query($query); 

?> 

<table class="listing"> 
<thead> 
    <tr> 
     <td>Author ID</td> 
     <th>Author E-Mail</th> 
     <th>Author Name</th> 
     <th>Delete</th> 
    </tr> 
</thead> 
<tbody> 
    <?php 
    for ($i = 0; $row = mysql_fetch_array($result); $i++) { 
     if ($i % 2 == 0) { 
      echo '<tr class="even">'; 
     } else { 
      echo '<tr class="odd">'; 
     } 
     echo "<td>{$row['author_id']}</td>"; 
     echo "<td>{$row['Email']}</td>"; 
     echo "<td>{$row['Name']}</td>"; 
     echo "<td><a href=\"del-user.php?term={$row['author_id']}\" onclick=\"javascript:return confirm('Are you sure you want to delete this user?')\">X</a></td>"; 
     echo '</tr>'; 
    } 
    ?> 
</tbody> 
</table> 

这是我的德尔 - user.php的页面：

<?php 
include('inc/config.php'); 
$title = 'Delete Individual User'; 
include('inc/db.php'); 
include('inc/header.php'); 

echo '<h2>Delete</h2>'; 

if (isset($GET['term'])) { 
$query = "DELETE FROM authors WHERE author_id = {$GET['term']} LIMIT 1"; 
mysql_query($query) or die('Failed to delete user'); 
echo '<p>User Deleted</p>'; 
echo '<p>Back to <a href="manage-users.php">Manage Users </>.</p>'; 
} else { 
echo '<p>Tried to Delete: "'; 
echo ($GET['term']); 
echo '"</p>'; 
echo '<p>Nothing to Delete</p>';  
} 

include('inc/footer.php'); 
?> 

我是新来的PHP，但是这不工作时，AUTHOR_ID值没有被传递到其他页面，而是留空。所以我不能从del-users.php页面删除任何内容。

我猜，这是问题的一部分：

echo "<td><a href=\"del-user.php?term={$row['author_id']}\" onclick=\"javascript:return confirm('Are you sure you want to delete this user?')\">X</a></td>"; 

任何人知道为什么发生这种情况？

Answer 1

几个问题：？

你发送的数据是这样的：

del-user.php?term={$row['author_id']} 

这样就意味着actualy $ _GET [ 'term']包含id。

您赶上这样的值：

if (isset($_GET['author_id'])) { 
$query = "DELETE FROM authors WHERE author_id = {$_GET['author_id']} LIMIT 1"; 

而且这是不好的，因为$ _GET [“术语”]包含的ID，所以你必须修复下一个看起来像这样：

if (isset($_GET['term'])) 
$query = "DELETE FROM authors WHERE author_id = {mysql_real_escape_string($_GET['term'])} LIMIT 1"; 

你也需要扩大选择查询，因为你没有actualy从数据库获取的AUTHOR_ID：

$query = 'SELECT author_email as Email, author_name as Name, author_id 
     FROM authors 
     ORDER BY Name 
     LIMIT 0, 30'; 

请逃不过你的变量，你特罗他们到数据库之前...

http://php.net/manual/en/function.mysql-real-escape-string.php

干杯

Answer 2

使用AUTHOR_ID在查询

<?php 
$query = 'SELECT author_id, author_email as Email, author_name as Name 
     FROM authors 
     ORDER BY Name 
     LIMIT 0, 30'; 

$result = mysql_query($query); 

>

Answer 3

问题是您的查询！

$query = 'SELECT author_email as Email, author_name as Name 
    FROM authors 
    ORDER BY Name 
    LIMIT 0, 30'; 

你没有选择author_id

Answer 4

你通过用户ID在URL这样的：

echo "<td><a href=\"del-user.php?term={$row['author_id']}\" 

的，你必须得到term，不author_id：

$query = "DELETE FROM authors WHERE author_id = {$GET['term']} LIMIT 1"; 

顺便说一下，您应该阅读有关准备好的查询和sql注释ection;）