php -基于id更新数据库中的数据？

Question

我正在做一个让学生上课的项目，我想通过PHP更新数据库数据，同时运行一个SQL函数UPDATE，但是我希望能够根据数据的id来更新它。

这是我目前正在使用的代码。

​

<?php

require_once './dba.php';

$status = "";

if(isset($_POST['time_in'])) {

    $query = "INSERT INTO nameOfTable (datetime) VALUES (NOW())";

    $d = $conn->prepare($query);

    $d->execute();     

} elseif(isset($_POST['time_out'])) {
    $query = "UPDATE nameOfTable SET datetime = NOW() WHERE id = ? ";

    $d = $conn->prepare($query);

    $d->execute();     
} else {
    $status = "Can't time in!";
}

​

Answer 1

使用$conn->lastInsertId()获取当它们进入时分配的ID。将其保存在会话变量中，并在它们超时时使用它。

<?php

require_once './dba.php';

$status = "";

if(isset($_POST['time_in'])) {
    $query = "INSERT INTO nameOfTable (datetime) VALUES (NOW())";
    $d = $conn->prepare($query);
    $d->execute();     
    $_SESSION['clock_id'] = $conn->lastInsertId();
} elseif(isset($_POST['time_out'])) {
    if (!isset($_SESSION['clock_id'])) {
      $status = "You need to clock in first!";
    } else {
      $query = "UPDATE nameOfTable SET datetime = NOW() WHERE id = :id ";
      $d = $conn->prepare($query);
      $d->execute(['id' => $_SESSION['clock_id']]);   
    }
} else {
    $status = "Can't time in!";
}

Answer 2

您必须记住准备查询并将参数绑定到它。

使用$id变量准备具有适当ID的查询。

在将ID传递给查询之前，请确保对会话进行身份验证，否则攻击者可以操纵此数据以获取任何他们想要的数据。

// Its helpful to create elements within the code to bind onto. :id is ours.
$query = "UPDATE nameOfTable SET datetime = NOW() WHERE id = :id ";

$d = $conn->prepare($query);

// Run the query & bind id to :id
$d->execute(['id' => $id]); 

Answer 3

你试着更新

    $query = "UPDATE nameOfTable SET datetime = NOW() WHERE id = :id ";

    $d = $conn->prepare($query);

    $d->execute(['id' => $id ]);