sql INSERT与php表单失败

I have an update form which I am trying to enable updating fields but struggling to update the fields when submitting - perhaps I am missing something very obvious here.

我有一个更新表单,我试图启用更新字段,但在提交时努力更新字段 - 也许我错过了一些非常明显的东西。

Here is my form:

这是我的表格:

<form action="actions/updateDoc.php" method="POST">

    <input type="text" value="<?php echo $doc['doc_title'] ?>" name="doc_title" />
    <br />

    <input type="submit" value="Update" name="submit" />    
</form>

Here is the script to action that form:

以下是表单的操作脚本:

    <?php

    if(isset($_POST["submit"])){
    $hostname='localhost';
    $username='******';
    $password='******';

    try {

    $dbh = new PDO("mysql:host=$hostname;dbname=******",$username,$password);

    $dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); // <== add this line

$doc_title = $_POST['doc_title'];

$sql = "UPDATE doc_list (doc_title) SET ('".$_POST["doc_title"]."')";

if ($dbh->query($sql)) {
    header ('Location: ../docEdit.php');
}
else{
}

$dbh = null;
}
catch(PDOException $e)
{
echo $e->getMessage();
}

}
?>

The script runs but getting a blank screen and no update occurs. I have now taken some code out to show just updating 1 row, I get the following error:

该脚本运行但获得一个空白屏幕并且不进行更新。我现在已经采取了一些代码来显示只更新1行,我得到以下错误:

SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '(doc_title) SET ('Document content sdfsd')' at line 1

1 个解决方案

#1

First, add the doc_id to your form (as a hidden input) -

首先,将doc_id添加到表单中(作为隐藏输入) -

<form action="actions/updateDoc.php" method="POST">

    <input type="text" value="<?php echo $doc['doc_title'] ?>" name="doc_title" />
    <input type="hidden" value="<?php echo $doc['doc_id'] ?>" name="doc_id" />
    <br />

    <input type="submit" value="Update" name="submit" />    
</form>

Then change your php code to get the doc_id (and use prepared statement/placeholders) -

然后更改您的PHP代码以获取doc_id(并使用预准备语句/占位符) -

<?php

    if(isset($_POST["submit"])){
    $hostname='localhost';
    $username='******';
    $password='******';

    try {

    $dbh = new PDO("mysql:host=$hostname;dbname=******",$username,$password);

    $dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); // <== add this line



$sql = "UPDATE doc_list SET doc_title = :doc_title WHERE doc_id = :doc_id";
$query = $dbh->prepare($sql);
$query->execute(array(":doc_title"=>$_POST["doc_title"], ":doc_id"=> $_POST["doc_id"]));

if ($query) {
    header ('Location: ../docEdit.php');
}
else{
}

$dbh = null;
}
catch(PDOException $e)
{
echo $e->getMessage();
}

}
?>

#1