PHP中使用$_POST变量无法更新数据库行的问题解决咨询

Alright, let's break down why your $_POST variables aren't updating the database and fix this properly.

Key Issues in Your Current Code #

• Only updating one field: Your SQL statement only targets remindone (for remind1), but you have 5 input fields—none of the other user inputs are being saved to the database.
• SQL injection & special character conflicts: Directly inserting $_POST values into your SQL query will fail if users type characters like single quotes ('), and it’s a critical security risk (SQL injection). This is exactly why hardcoded strings work (they don’t have special characters) but user input breaks the query.
• Database connection typo: You used $conn->connect_error instead of $con->connect_error in error handling, which throws an undefined variable error.
• Missing session initialization: You’re using $_SESSION variables but didn’t add session_start() at the top of your PHP file—this means your user session data won’t be accessible at all.

Step-by-Step Fix #

1. Updated PHP Code (Secure & Functional) #

Replace your existing PHP code with this version, which addresses all the above issues:

<?php
// Must start session first to access $_SESSION variables
session_start();

// Verify user is logged in before allowing updates
if (!isset($_SESSION['u_uid'])) {
    echo "<script>alert('Please log in to save reminders.'); window.location.href='login.php';</script>";
    exit;
}

$uid = $_SESSION['u_uid']; 
$con = mysqli_connect("localhost", "root", "pass123", "db_name"); 

// Fix connection error variable name
if ($con->connect_error) { 
    die("Connection failed: " . $con->connect_error);
} 

if (isset($_POST['updBtn'])){ 
    // Safely retrieve POST values, default to empty string if not set
    $remind1 = $_POST['remind1'] ?? '';
    $remind2 = $_POST['remind2'] ?? '';
    $remind3 = $_POST['remind3'] ?? '';
    $remind4 = $_POST['remind4'] ?? '';
    $remind5 = $_POST['remind5'] ?? '';

    // Use prepared statements to avoid SQL injection and handle special characters
    $sql = "UPDATE reminders SET remindone=?, remindtwo=?, remindthree=?, remindfour=?, remindfive=? WHERE username=?";
    $stmt = $con->prepare($sql);
    // Bind parameters: "ssssss" means 6 string values (5 reminders + username)
    $stmt->bind_param("ssssss", $remind1, $remind2, $remind3, $remind4, $remind5, $uid);

    if ($stmt->execute()) { 
        echo "<script>alert('Reminders updated successfully!'); window.location.href='body.php';</script>";
    } else { 
        // Show specific error for easier debugging
        echo "<script>alert('Update failed: " . $stmt->error . "');</script>";
    }

    // Clean up database resources
    $stmt->close();
}

$con->close();
?>

2. Minor HTML Adjustment (Better UX) #

Move the submit button to the bottom of the form (more intuitive for users):

<form action="body.php" method="post"> 
    <input type="text" class="event" name="remind1" placeholder="Reminder 1"><br> 
    <input type="text" class="event" name="remind2" placeholder="Reminder 2"><br> 
    <input type="text" class="event" name="remind3" placeholder="Reminder 3"><br> 
    <textarea class="event" name="remind4" placeholder="Reminder 4"></textarea><br> 
    <textarea class="event" name="remind5" placeholder="Reminder 5"></textarea><br> 
    <input type="submit" class="sideBtn" value="Save Changes" name="updBtn"><br> 
</form>

Why This Works #

• Prepared Statements: By using prepare() and bind_param(), we let MySQL automatically handle special character escaping—this fixes the "user input breaks SQL" problem and eliminates SQL injection risks entirely.
• Full Field Update: All 5 reminder fields are now included in the UPDATE query, so every user input gets saved to the database.
• Session Validation: We check if the user is logged in before allowing updates, adding basic security to prevent unauthorized changes.
• Clear Error Handling: Specific SQL errors are displayed, making it easy to debug if something goes wrong.

Do You Have to Use $_POST? #

No, you don’t have to use $_POST, but it’s the best choice for this scenario:

• $_GET is an alternative, but it exposes data in the URL (not secure for user content) and has strict length limits.
• You could use AJAX (with JavaScript’s fetch or XMLHttpRequest) to submit data asynchronously (no page refresh), but under the hood, it still uses POST requests, and PHP will retrieve the data via $_POST.
• For advanced use cases, you could read raw POST data with file_get_contents('php://input'), but this is more complex and unnecessary for standard form submissions.

内容的提问来源于stack exchange，提问作者sunidhi