PHP MYSQLでPOST FORMを短くする

Question

私はanglejs PHPフォームポストを使って行を挿入または更新しています。現在、以下の作業例があります。これを短時間で記述できるかどうかを知りたいので、UPDATEとINSERTの両方のシナリオで使用できます。私は定義された値だけでなくフォーム全体を提出したい。手伝ってくれてありがとう。

function update($con){ 
$postdata = file_get_contents("php://input", true); 
$request = json_decode($postdata); 

$idx = $request->idx; 
$images = $request->images; 
$collection = $request->collection; 
$title = $request->title; 
$description = $request->description; 
$height = $request->height; 
$width = $request->width; 
$length = $request->length; 
$weight = $request->weight; 
$price = $request->price; 
$availability = $request->availability; 
$active = $request->active; 
$method = $request->method; 
$searchkeys = $request->searchkeys; 
$materialused = $request->materialused; 
if(is_array($images)){ 
    $implodeImg = implode(',', $images); 
}else{ 
    $implodeImg = $images; 
} 

$sqlIn = "UPDATE prodList_1 SET 
idx = '$idx', 
images = '$implodeImg', 
collection = '$collection', 
title = '$title', 
description = '$description', 
height = '$height', 
width = '$width', 
length = '$length', 
weight = '$weight', 
price = '$price', 
availability = '$availability', 
active = '$active', 
method = '$method', 
searchkeys = '$searchkeys', 
materialused = '$materialused' 
WHERE idx = '$idx'"; 

if (mysqli_query($con, $sqlIn)) { 
    echo "Record Updated successfully"; 
} else { 
    echo "Error: " . $sqlIn . "<br>" . mysqli_error($con); 
} 

} 

Answer 1

は私がmysqliを使ったことがないし、おそらく決してこれをやった後、私はそれには、次のようなものになるだろうと信じて：

これができるかどうかあなたの質問の面で

function update($con) { 
    $postdata = file_get_contents("php://input", true); 
    $request = json_decode($postdata); 

    $idx = $request->idx; 
    $images = $request->images; 
    $collection = $request->collection; 
    $title = $request->title; 
    $description = $request->description; 
    $height = $request->height; 
    $width = $request->width; 
    $length = $request->length; 
    $weight = $request->weight; 
    $price = $request->price; 
    $availability = $request->availability; 
    $active = $request->active; 
    $method = $request->method; 
    $searchkeys = $request->searchkeys; 
    $materialused = $request->materialused; 

    if (is_array($images)) { 
     $implodeImg = implode(',', $images); 
    }else{ 
     $implodeImg = $images; 
    } 

    // using INSERT ... ON DUPLICATE KEY UPDATE syntax 
    // make sure idx is PRIMARY KEY 
    $sql = " 
     INSERT INTO table 
     (idx, images, collection, title, description, height, 
     width, length, weight, price, availability, active, 
     method, searchkets, materialused) 
     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) 
     ON DUPLICATE KEY UPDATE 
     images = VALUES(images), collection = VALUES(collection), 
     title = VALUES(title), description = VALUES(description), 
     height = VALUES(height), width = VALUES(width), 
     length = VALUES(length), weight = VALUES(weight), 
     price = VALUES(price), availability = VALUES(availability), 
     active = VALUES(active), method = VALUES(method), 
     searchkeys = VALUES(searchkeys), materialused = VALUES(materialused) 
    "; 

    // never trust user-submitted data 
    // use prepared statement 
    $stmt = mysqli_prepare($con, $sql); 

    $stmt->bind_param(
     $stmt, 
     'sssssssssssssss', 
     $idx, $implodeImg, $collection, $title, $description, 
     $height, $width, $length, $weight, $price, $availability, $active, 
     $method, $searchkeys, $materialused 
    ); 

    mysqli_stmt_execute($stmt); 

    if (mysqli_stmt_affected_rows($stmt)) { 
     echo "Record Updated successfully"; 
    } else { 
     echo "Error: " . $sqlIn . "<br>" . mysqli_error($con); 
    } 
} 

..だから短い方法で書かれていますか？あんまり。しかし、あなたはINSERT ... ON DUPLICATE KEY UPDATE syntaxを使用して1つの石で2羽の鳥を殺すことができます。

Answer 2

あなたのコードはSQL Injectableです。パラメータ化やその他の方法でSQLインジェクションを防止する方法を調べたいと思うでしょう。ただし、これを行うには、$requestを配列として使用し、foreachループを使用できます。このようなおそらく何か：

$request = [ 
    "idx" = "idx", 
    "images" => "implodeImg", 
    "collection" => "collection", 
    "title" => "title", 
    "description" => "description", 
    "height" => "height", 
    "width" => "width", 
    "length" => "length", 
    "weight" => "weight", 
    "price" => "price", 
    "availability" => "availability", 
    "active" => "active", 
    "method" => "method", 
    "searchkeys" => "searchkeys", 
    "materialused" => "materialused" 
]; 
$sql = "UPDATE prodList_1 SET"; 

$last_key = end(array_keys($request)); // Grab the last key and remove comma if present in $sql 
foreach($request as $k => $v) { 
    if($last_key !== $k) { 
     $sql .= "$k = $$v, "; 
    } else { 
     $sql .= "$k = $$v "; 
    } 
} 
$sql .= "WHERE idx = '$idx'"; 
if (mysqli_query($con, $sqlIn)) { 
    echo "Record Updated successfully"; 
} else { 
    echo "Error: " . $sqlIn . "<br>" . mysqli_error($con); 
} 

あなたはecho $sql;あなたのパラメータが正しく解析されているかどうかを確認することができます。