PHP中通过编辑按钮传递客户ID并在另一页面使用的实现方案

Alright, let's get this edit flow working smoothly. I'll break it down into three key parts: fixing the edit button link, fetching customer data in edit.php, and handling the form submission to update the database.

1. Correct the Edit Button Link in index.php #

First, let's fix the syntax in your edit button's href attribute—your current quote structure is off, which will break the URL. Assuming your customer ID column is named customer_id (adjust if your actual column name is different), here's the corrected code for the edit button:

<!-- Inside your table row loop in index.php -->
<tr>
    <td><?php echo htmlspecialchars($row['full_name']); ?></td>
    <td><?php echo htmlspecialchars($row['email']); ?></td>
    <td><?php echo htmlspecialchars($row['address']); ?></td>
    <td>
        <a href="edit.php?id=<?php echo $row['customer_id']; ?>">Edit</a>
    </td>
</tr>

Note: I added htmlspecialchars() to prevent XSS attacks—always escape user data when outputting it to HTML!

2. Fetch Customer Data & Build the Edit Form in edit.php #

Next, in edit.php, we need to:

• Grab the customer ID from the URL parameter
• Validate it's a valid number (to avoid invalid requests)
• Fetch the corresponding customer data from the database
• Populate the form fields with that data

Here's a complete example (adjust database credentials and table/column names to match your setup):

<?php
// Database connection (use your own credentials)
$servername = "localhost";
$username = "your_username";
$password = "your_password";
$dbname = "your_database";

$conn = new mysqli($servername, $username, $password, $dbname);
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// Get and validate customer ID from URL
if (!isset($_GET['id']) || !is_numeric($_GET['id'])) {
    die("Invalid customer ID");
}
$customer_id = $_GET['id'];

// Fetch customer data using prepared statement (prevents SQL injection)
$stmt = $conn->prepare("SELECT full_name, email, address FROM customers WHERE customer_id = ?");
$stmt->bind_param("i", $customer_id);
$stmt->execute();
$result = $stmt->get_result();
$customer = $result->fetch_assoc();

if (!$customer) {
    die("Customer not found");
}
?>

<!-- Edit Form -->
<form method="POST" action="edit.php?id=<?php echo $customer_id; ?>">
    <div>
        <label for="full_name">Full Name:</label>
        <input type="text" id="full_name" name="full_name" value="<?php echo htmlspecialchars($customer['full_name']); ?>" required>
    </div>
    <div>
        <label for="email">Email:</label>
        <input type="email" id="email" name="email" value="<?php echo htmlspecialchars($customer['email']); ?>" required>
    </div>
    <div>
        <label for="address">Customer Address:</label>
        <textarea id="address" name="address" required><?php echo htmlspecialchars($customer['address']); ?></textarea>
    </div>
    <button type="submit">Save Changes</button>
</form>

3. Handle Form Submission to Update Data #

Add this code at the top of edit.php (before fetching the customer data) to handle the form POST request:

// Handle form submission
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Validate and sanitize input
    $full_name = trim($_POST['full_name']);
    $email = trim($_POST['email']);
    $address = trim($_POST['address']);

    if (empty($full_name) || empty($email) || empty($address)) {
        die("All fields are required");
    }

    // Update customer data using prepared statement
    $stmt = $conn->prepare("UPDATE customers SET full_name = ?, email = ?, address = ? WHERE customer_id = ?");
    $stmt->bind_param("sssi", $full_name, $email, $address, $customer_id);
    
    if ($stmt->execute()) {
        // Redirect back to index.php after successful update
        header("Location: index.php?success=1");
        exit();
    } else {
        echo "Error updating record: " . $conn->error;
    }
}

Key Notes for Security & Best Practices #

• Always use prepared statements (like in the examples above) to prevent SQL injection attacks.
• Escape output with htmlspecialchars() to avoid cross-site scripting (XSS) vulnerabilities.
• Validate all user input (check for empty fields, valid email format, etc.) before processing.
• After a successful update, redirect the user back to index.php instead of showing a message directly—this prevents duplicate submissions if they refresh the page.

内容的提问来源于stack exchange，提问作者faro621