PHP账单支付功能异常：为何代码更新随机行而非指定行？

核心错误点 #

• 无法识别点击的按钮对应哪条账单：所有提交按钮的name都是odeme，表单提交后无法区分用户操作的是哪一行记录，导致无法定位目标账单。
• POST处理逻辑嵌套循环内：每次提交表单时，while循环会遍历所有账单行，每一行都会执行一次UPDATE操作，最终实际生效的是最后一次循环的更新，造成“随机更新行”的错觉。
• 存在SQL注入风险：直接将变量拼接到SQL语句中，没有做任何安全处理，容易被注入攻击。

修复步骤 #

1. 给按钮添加唯一标识，绑定对应账单ID #

通过隐藏输入框存储账单ID，或者给按钮name添加ID后缀，让提交后能精准定位要处理的账单：

<td>
    <input type="hidden" name="bill_id" value="<?php echo $row['id']; ?>">
    <input name="odeme" type="submit" value="Öde" class="btn btn-primary">
</td>

2. 将POST处理逻辑移到循环外部 #

把表单提交的处理代码放在账单查询循环之前，确保只执行一次处理逻辑，避免重复更新：

<?php
// 先处理POST请求，放在循环外面
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $bill_id = isset($_POST['bill_id']) ? (int)$_POST['bill_id'] : null;

    if ($bill_id) {
        // 根据账单ID获取对应金额（用预处理语句防注入）
        $sel_bill_stmt = $svcon->prepare("SELECT amount FROM billing WHERE id = ? AND identifier = ?");
        $sel_bill_stmt->bind_param("is", $bill_id, $cid);
        $sel_bill_stmt->execute();
        $bill_result = $sel_bill_stmt->get_result();
        
        if ($bill_row = $bill_result->fetch_assoc()) {
            $fatMiktar = $bill_row['amount'];
            $yeniMiktar = $BankaAl - $fatMiktar;
            $yeniAccount = array("bank"=>$yeniMiktar, "money"=>$NakitAl, "black_money"=>$BlackAl);
            $bankEncode = json_encode($yeniAccount);

            // 更新用户账户（预处理语句）
            $update_stmt = $svcon->prepare("UPDATE users set accounts = ? WHERE id = ?");
            $update_stmt->bind_param("si", $bankEncode, $cid);
            $update_stmt->execute();

            // 可选：删除已支付的账单
            $delete_stmt = $svcon->prepare("DELETE FROM billing WHERE id = ? AND identifier = ?");
            $delete_stmt->bind_param("is", $bill_id, $cid);
            $delete_stmt->execute();

            // 跳转避免重复提交
            header("Location: {$_SERVER['PHP_SELF']}");
            exit;
        }
    }
}

// 再查询账单列表
$count=1;
$sel_stmt = $svcon->prepare("SELECT * from billing WHERE identifier= ?");
$sel_stmt->bind_param("s", $cid);
$sel_stmt->execute();
$result = $sel_stmt->get_result();
?>

3. 替换Refresh跳转方式 #

用header("Location: {$_SERVER['PHP_SELF']}")替代header("Refresh:0")，符合HTTP规范，防止表单重复提交。

4. 全面修复SQL注入问题 #

所有SQL操作都使用预处理语句，禁止直接拼接变量到SQL字符串中，彻底避免注入风险。

完整修复后的代码示例 #

<form name="faturalar" method="POST">
<h4> Ödenmemiş Faturalarım </h4>
<br>
<table class="table table-striped table-dark">
<thead>
    <tr style="color:white">
        <th> # </th>
        <th> Ceza </th>
        <th> Miktar </th>
        <th> Ödeme </th>
    </tr> 
</thead>

<tbody>
    <?php
    // 处理POST提交逻辑
    if ($_SERVER['REQUEST_METHOD'] === 'POST') {
        $bill_id = isset($_POST['bill_id']) ? (int)$_POST['bill_id'] : null;

        if ($bill_id) {
            // 获取对应账单金额
            $sel_bill_stmt = $svcon->prepare("SELECT amount FROM billing WHERE id = ? AND identifier = ?");
            $sel_bill_stmt->bind_param("is", $bill_id, $cid);
            $sel_bill_stmt->execute();
            $bill_result = $sel_bill_stmt->get_result();
            
            if ($bill_row = $bill_result->fetch_assoc()) {
                $fatMiktar = $bill_row['amount'];
                $yeniMiktar = $BankaAl - $fatMiktar;
                $yeniAccount = array("bank"=>$yeniMiktar, "money"=>$NakitAl, "black_money"=>$BlackAl);
                $bankEncode = json_encode($yeniAccount);

                // 更新用户账户
                $update_stmt = $svcon->prepare("UPDATE users set accounts = ? WHERE id = ?");
                $update_stmt->bind_param("si", $bankEncode, $cid);
                $update_stmt->execute();

                // 删除已支付账单
                $delete_stmt = $svcon->prepare("DELETE FROM billing WHERE id = ? AND identifier = ?");
                $delete_stmt->bind_param("is", $bill_id, $cid);
                $delete_stmt->execute();

                header("Location: {$_SERVER['PHP_SELF']}");
                exit;
            }
        }
    }

    // 查询账单列表
    $count=1;
    $sel_stmt = $svcon->prepare("SELECT * from billing WHERE identifier= ?");
    $sel_stmt->bind_param("s", $cid);
    $sel_stmt->execute();
    $result = $sel_stmt->get_result();
    while($row = mysqli_fetch_assoc($result)) { 
    ?>
    <tr>
        <td><?php echo $count; ?></td>
        <td><?php echo $row["label"]; ?></td>
        <td><?php echo $row["amount"]; ?></td>
        <td>
            <input type="hidden" name="bill_id" value="<?php echo $row['id']; ?>">
            <input name="odeme" type="submit" value="Öde" class="btn btn-primary">
        </td>
    </tr>
    <?php $count++; } ?>
</tbody>
</table> 
</form>

内容的提问来源于stack exchange，提问作者IAMGOKTURK