0

これは私のフォーム ページ editFormpackage.php
です。データをフォームに戻して更新することはできますが、値を変更して [更新] をクリックすると、フォームが保存されません。 

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title> AB Delivery </title>
<title> *Please enter details of employee took order. </title>
<link rel="stylesheet" type="text/css" href="style.css" />
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title> AB Delivery </title>
<link rel="stylesheet" type="text/css" href="style.css" />
<link href= rel='stylesheet' type='text/css'>
<!-- jQuery file -->
<script src="js/jquery.min.js"></script>
<script src="js/jquery.tabify.js" type="text/javascript" charset="utf-8"></script>
<script type="text/javascript">
var $ = jQuery.noConflict();
$(function() {
$('#tabsmenu').tabify();
$(".toggle_container").hide(); 
$(".trigger").click(function(){
    $(this).toggleClass("active").next().slideToggle("slow");
    return false;
});
});
</script>
</head>
<body>
<div id="panelwrap">

    <div class="header">
    <div class="title"><a href="#">AB Delivery</a></div>

    <div class="header_right">Welcome Admin </div>

    <div class="menu">
    <ul>
    <li><a href="http://localhost/delivery2/homepage.html" class="selected">New Entry</a></li>
    <li><a href="http://localhost/delivery2/showall.php">Show All</a></li>
    <li><a href="http://localhost/delivery2/edit.php">Edit</a></li>
    <li><a href="http://localhost/delivery2/search.html">Search</a></li>
    </ul>
    </div>


   <div class="center_content">  

    <div id="right_wrap">
    <div id="left_content">             
    <h2>Tables section</h2> 


<table id="rounded-corner">



<?php
$con = mysql_connect("localhost","root","");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("delivery", $con);

if(isset($_GET['package_id']))
{
$package_id=$_GET['package_id'];
if(isset($_POST['submit']))
{
$customer_id=$_POST['customer_id'];
$order_taken_by_employee_id=$_POST['order_taken_by_employee_id'];
$package_details=$_POST['package_details'];
$result=mysql_query("UPDATE package SET customer_id ='$customer_id',order_taken_by_employee_id='$order_taken_by_employee_id', package_details='$package_details' where package_id='$package_id'");
if($result)
{
header('location:edit.php');
}
}
$query1=mysql_query("SELECT * FROM package  WHERE package_id='$package_id'");
$query2=mysql_fetch_array($query1);
?>
<form method="post" action="http://localhost/delivery2/editFormpackage.php">
Customer ID:<input type="text" name="customer_id" value="<?php echo $query2['customer_id']; ?>" /><br />
Order Taken by Employee ID:<input type="text" name="order_taken_by_employee_id" value="<?php echo $query2['order_taken_by_employee_id']; ?>" /><br /><br />
Package Details:<input type="text" name="package_details" value="<?php echo $query2['package_details']; ?>" /><br /><br />
<br />
<input type="submit" name="submit" value="update" />
</form>


<?php
}
?>



 <div 



    <div class="clear"></div>
    </div> <!--end of center_content-->

    <div class="footer">
AB Delivery 
</div>

</div>


</body>
</html>

これは、すべてのテーブルを更新するための新しいページを作成したことがわかるように、edit.php のコードです。

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title> AB Delivery </title>
<title> *Please enter details of employee took order. </title>
<link rel="stylesheet" type="text/css" href="style.css" />
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title> AB Delivery </title>
<link rel="stylesheet" type="text/css" href="style.css" />
<link href= rel='stylesheet' type='text/css'>
<!-- jQuery file -->
<script src="js/jquery.min.js"></script>
<script src="js/jquery.tabify.js" type="text/javascript" charset="utf-8"></script>
<script type="text/javascript">
var $ = jQuery.noConflict();
$(function() {
$('#tabsmenu').tabify();
$(".toggle_container").hide(); 
$(".trigger").click(function(){
    $(this).toggleClass("active").next().slideToggle("slow");
    return false;
});
});
</script>
</head>
<body>
<div id="panelwrap">

    <div class="header">
    <div class="title"><a href="#">AB Delivery</a></div>

    <div class="header_right">Welcome Admin </div>

    <div class="menu">
    <ul>
    <li><a href="http://localhost/delivery2/homepage.html" class="selected">New Entry</a></li>
    <li><a href="http://localhost/delivery2/showall.php">Show All</a></li>
    <li><a href="http://localhost/delivery2/edit.php">Edit</a></li>
    <li><a href="http://localhost/delivery2/search.html">Search</a></li>
    </ul>
    </div>


   <div class="center_content">  

    <div id="right_wrap">
    <div id="left_content">             
    <h2>Tables section</h2> 


<table id="rounded-corner">


<?php
$con = mysql_connect("localhost","root","");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("delivery", $con);

$result = mysql_query("SELECT * FROM customers");



echo "<table border='19'>
<tr>
<th>Customer ID</th>
<th>Customer Address ID</th>
<th>Name</th>
<th>Phone Number</th>
<th>Email</th>
<th>Action</th>
</tr>";

while($row1 = mysql_fetch_array($result))

  {
  echo "<tr>";
  echo "<td>" . $row1['customer_id'] . "</td>";
  echo "<td>" . $row1['customer_address_id'] . "</td>";
  echo "<td>" . $row1['customer_name'] . "</td>";
  echo "<td>" . $row1['customer_phone'] . "</td>";
  echo "<td>" . $row1['customer_email'] . "</td>";
  echo "<td><a href='editFormcustomers.php?customer_id=".$row1['customer_id']."'>Edit</a></td>";
echo "<td><a href='deletecustomers.php?customer_id=".$row1['customer_id']."'>x</a></td><tr>";
  }


echo "</tr>";

echo "</table>";

mysql_close($con);

?>

<?php
$con = mysql_connect("localhost","root","");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("delivery", $con);

$result = mysql_query("SELECT * FROM address");



echo "<table border='19'>
<tr>
<th>Address ID</th>
<th>Address </th>
<th>Action</th>
</tr>";

while($row2 = mysql_fetch_array($result))

  {
  echo "<tr>";
  echo "<td>" . $row2['address_id'] . "</td>";
  echo "<td>" . $row2['line_1'] . "</td>";
  echo "<td><a href='editFormaddress.php?address_id=".$row2['address_id']."'>Edit</a></td>";
echo "<td><a href='deleteaddress.php?address_id=".$row2['address_id']."'>x</a></td><tr>";
  }


echo "</tr>";

echo "</table>";

mysql_close($con);

?>

<?php
$con = mysql_connect("localhost","root","");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("delivery", $con);

$result = mysql_query("SELECT * FROM package");



echo "<table border='19'>
<tr>
<th>Packasge ID</th>
<th> Customer ID</th>
<th>Employee ID</th>
<th>Details</th>
<th>Action</th>
</tr>";

while($row3 = mysql_fetch_array($result))

  {
  echo "<tr>";
  echo "<td>" . $row3['package_id'] . "</td>";
  echo "<td>" . $row3['customer_id'] . "</td>";
  echo "<td>" . $row3['order_taken_by_employee_id'] . "</td>";
  echo "<td>" . $row3['package_details'] . "</td>";
    echo "<td><a href='editFormpackage.php?package_id=".$row3['package_id']."'>Edit</a></td>";
echo "<td><a href='deletepackage.php?package_id=".$row3['package_id']."'>x</a></td><tr>";


  }


echo "</tr>";

echo "</table>";

mysql_close($con);

?>

<?php
$con = mysql_connect("localhost","root","");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("delivery", $con);

$result = mysql_query("SELECT * FROM employee");



echo "<table border='19'>
<tr>
<th>Employee ID</th>
<th>Employee Name</th>
<th>Phone Number</th>
<th>Other Details</th>
<th>Action</th>
</tr>";

while($row4 = mysql_fetch_array($result))

  {
  echo "<tr>";
  echo "<td>" . $row4['employee_id'] . "</td>";
  echo "<td>" . $row4['employee_name'] . "</td>";
  echo "<td>" . $row4['employee_phone'] . "</td>";
  echo "<td>" . $row4['other_employee_details'] . "</td>";
    echo "<td><a href='editFormemployee.php?employee_id=".$row4['employee_id']."'>Edit</a></td>";
echo "<td><a href='deleteemployee.php?employee_id=".$row4['employee_id']."'>x</a></td><tr>";

  }


echo "</tr>";

echo "</table>";


mysql_close($con);

?>


  <div 



    <div class="clear"></div>
    </div> <!--end of center_content-->

    <div class="footer">
AB Delivery 
</div>

</div>


</body>
</html>
4

2 に答える 2

0

更新スクリプトの where 句はパッケージ ID を参照していますが、パッケージ ID がフォームに設定されていません。

$result=mysql_query("UPDATE package SET customer_id ='$customer_id',order_taken_by_employee_id='$order_taken_by_employee_id', package_details='$package_details' where package_id='$package_id'");

解決策にたどり着く前に、DB に直接アクセスする前にフォーム入力をサニタイズしていないため、SQL インジェクションに対して非常に脆弱であることを指摘する必要があります。http://us2.php.net/manual/en/function.mysql-real-escape-string.phpを正しい軌道に乗せるために、これをチェックしてください。

以下の解決策は機能しますが、POST でパッケージ ID を渡すことも技術的にハッキングされる可能性があります。サーバーまたは DB セッションで ID を渡すのが最も安全 ( PHP を使用して 2 つのページ間で変数を渡す最も安全な方法) ですが、以下の解決策を参考にしてください。

GET クエリ パラメータからパッケージ ID を設定していますが、フォームが送信されると、フォーム アクション パラメータで定義された URL に送信されます。ご覧のとおり、パッケージ ID はまだ含まれていません。

これを解決するには、package_id を非表示のフォーム変数として次のように追加する必要があります。

<form method="post" action="http://localhost/delivery2/editFormpackage.php">
 Customer ID:<input type="text" name="customer_id" value="<?php echo     $query2['customer_id']; ?>" /><br />
Order Taken by Employee ID:<input type="text" name="order_taken_by_employee_id" value="<?php echo $query2['order_taken_by_employee_id']; ?>" /><br /><br />
Package Details:<input type="text" name="package_details" value="<?php echo $query2['package_details']; ?>" /><br /><br />
<br />
<input type="hidden" name="package_id" value="<?php echo $query2['package_id'];?>" />
<input type="submit" name="submit" value="update" />
</form>

そして、次のように $_POST スーパーグローバルの package_id から package_id を設定します。

if(isset($_POST['submit']))
{
$package_id = $_POST['package_id'];
$customer_id=$_POST['customer_id'];
$order_taken_by_employee_id=$_POST['order_taken_by_employee_id'];
$package_details=$_POST['package_details'];
$result=mysql_query("UPDATE package SET customer_id ='$customer_id',order_taken_by_employee_id='$order_taken_by_employee_id', package_details='$package_details' where package_id='$package_id'");
// rest of your code
于 2013-04-23T05:07:04.117 に答える
0

これは正しいコードです: 

 <form method="post" action="http://localhost/delivery2/editFormpackage.php">
         Customer ID:<input type="text" name="customer_id" value="<?php echo     $query2['customer_id']; ?>" /><br />
        Order Taken by Employee ID:<input type="text" name="order_taken_by_employee_id" value="<?php echo $query2['order_taken_by_employee_id']; ?>" /><br /><br />
        Package Details:<input type="text" name="package_details" value="<?php echo $query2['package_details']; ?>" /><br /><br />
        <br />
        <input type="hidden" name="package_id" value="<?php echo $query2['package_id'];?>" />
        <input type="submit" name="submit" value="update" />
        </form>
于 2013-04-24T01:49:56.057 に答える