我正在寻找关于如何编辑我的模态内部 - 标题和注释的解决方案。下面是我的代码，我想在模态中的按钮内编辑。成功更新数据后，我想通过调用我的代码中的主页（hh.php）来显示更新的数据。
以下是我的代码：
<?php
if(isset($_GET['id'])){
$con=mysqli_connect("localhost","root","","task");
$qi=mysqli_query($con,"SELECT * FROM note WHERE id = ".$_GET['id']);
while($row=mysqli_fetch_assoc($qi)){
$tit = $row['title'];
$not = $row['note'];
}
}
?>
<html>
<head>
<script src="jquery-1.10.2.min.js"></script>
<style>
body
{
margin:0;
}
.submitted{
margin:0px;
}
.modal
{
width:100%;
height:100%;
position:fixed;
top:0;
display:none;
}
.modal_close
{
width:100%;
height:100%;
background:rgba(0,0,0,.8);
position:fixed;
top:0;
}
.close
{
cursor:pointer;
}
.note{
text-align:center;
}
#note{
font-family: Javanese text;
}
.call_modal{
font-family: myFirstFont;
}
.modal_main
{
width:50%;
height:400px;
background:#fff;
z-index:4;
position:fixed;
top:16%;
border-radius:4px;
left:24%;
display:none;
-webkit-animation-duration: .5s;
-webkit-animation-delay: .0s;
-webkit-animation-fill-mode: both;
-moz-animation-fill-mode: both;
-o-animation-fill-mode: both;
-webkit-backface-visibility: visible!important;
-webkit-animation-name: fadeInRight;
}
@-webkit-keyframes fadeInRight{0%{opacity:0;-webkit-transform:translateX(20px)}100%{opacity:1;-webkit-transform:translateX(0)}}
::-webkit-input-placeholder{
font-size: 13.4px;
}
button
{
padding:20px;
border-radius:5px;
background:#808080;
border:none;
font-size:18px;
color:#fff;
margin:8%;
}
</style>
<script>
$(document).ready(function(){
$(".call_modal").click(function(){
$(".modal").fadeIn();
$(".modal_main").show();
});
});
$(document).ready(function(){
$(".close").click(function(){
$(".modal").fadeOut();
$(".modal_main").fadeOut();
});
});
$(document).ready(function(){
$(".submitted").click(function(){
$(".modal").fadeOut();
$(".modal_main").fadeOut();
});
});
</script>
</head>
<body>
<button class="call_modal" style="cursor:pointer;"> Edit Task </button>
<div class="modal">
<div class="modal_close close"></div>
<div class="modal_main">
<div class="note"> <?php
$nameErr = $emailErr = $genderErr = $websiteErr = "";
$name = $email = $gender = $comment = $website = "";
if ($_SERVER["REQUEST_METHOD"] == "POST") {
if (empty($_POST["comment"])) {
$comment = "";
} else {
$comment = test_input($_POST["comment"]);
}
}
function test_input($data) {
$data = trim($data);
$data = stripslashes($data);
$data = htmlspecialchars($data);
return $data;
}
?>
<form method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>">
<div id="name">Task Name:<textarea name="title" rows="1.8" cols="20" style="margin-top: 50px"><?php echo $tit;?></textarea></div>
<textarea name="note" rows="15" cols="90" style="margin-top: 20px" placeholder="Note"><?php echo $not;?></textarea>
<br><br>
<input type="submit" name="submit" class="submitted" value="Submit">
<?php
$con=mysqli_connect("localhost","root","","task");
if(isset($_POST['submit'])){
$message=$_POST['note'];
$title=$_POST['title'];
$qw='UPDATE note SET title = $title, note = $message';
mysqli_query($con,$qw);
$r="SELECT * FROM note";
$result = mysqli_query($con, $r);
while($row = mysqli_fetch_assoc($result)){
if($row['title']==$_POST['title']){
header("location:hh.php");
}
else{
echo 'Title already exist!';
}
}
}
?>
</form>
<img src="i783wQYjrKQ.png" class="close" style="line-height: 12px;
margin-top: 1px;
margin-right: 2px;
position:absolute;
top:0;
right:0;">
</div>
</div>
</body>
</html>
快速浏览一下代码，您就会对SQL注入攻击敞开大门。
<?php
if(isset($_GET['id']))
{
$con = mysqli_connect("localhost","root","","task");
$qi = mysqli_query($con, "SELECT 'title', 'note' FROM note WHERE id = ".$_GET['id']);
$row = mysqli_fetch_assoc($qi))
$tit = $row['title'];
$not = $row['note'];
}
?>
我将着眼于使用PHP PDO库来防止在SQL代码中直接使用从网页传入的值。
我会使用更类似于：
$host = 'localhost';
$db = 'task';
$user = 'root';
$pass = '';
$charset = 'utf8mb4';
$dsn = "mysql:host=$host;dbname=$db;charset=$charset";
$options = [
PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
PDO::ATTR_EMULATE_PREPARES => false,
];
try {
$pdo = new PDO($dsn, $user, $pass, $options);
} catch (\PDOException $e) {
throw new \PDOException($e->getMessage(), (int)$e->getCode());
}
$stmt = $pdo->prepare('SELECT title, note FROM note WHERE id = :id');
$stmt->execute(['id' => $_GET['id']]);
$row = $stmt->fetch();
$tit = $row['title'];
$not = $row['note'];
显然，连接细节等将保存在单独的外部文件中，这样它们就不必包含在需要DB访问的每个PHP文件中。