Basic wpdb update question

时间:2019-11-20 作者:RichyR

我不能让它工作,我真的不知道如何调试它。在URL中,我要添加以下内容:?候选资格=41(&P);selectCandidate=selectCandidate

global $wpdb;


    if(isset($_POST[\'selectCandidate\']))
    {
        global $wpdb;
        $selected_candidate = $_POST[\'candidat\'];  // Storing Selected Value In Variable
          $wpdb->query( $wpdb->prepare("UPDATE pp_candidates 
            SET candidate_approved = 1  WHERE candidate_ID = \'".$selected_candidate."\' "));
          $wpdb->show_errors();

    }

    if (!isset($_POST[\'candidatebutton\'])) 
        {echo \'<div class="projectcandidatelist"></div>\';
        }
    else
    {
    echo \'<div class="projectcandidatelist"><form action="" id="candidat_list">\';

    $project_candidat = $wpdb->get_results("SELECT *  FROM pp_candidates WHERE project_ID =\'".$_POST[\'candidatebutton\']."\' ");

    foreach($project_candidat as $candidat)
        {
        echo    \'<p><input type="radio" name="candidat" value="\'.$candidat->candidate_ID.\'" >
        <a href="\'.$candidat->candidate_url.\'">\'.$candidat->candidate_displayname.\'</a></p>\';
        }
        echo \'<input type="submit" value="selectCandidate" name="selectCandidate">\';

        echo \'</form></div>\';   
    }
我希望(tinyint)“候选人批准”一栏转到1。提前谢谢。

1 个回复
最合适的回答,由SO网友:Vincent 整理而成

我认为应该是:

$selected_candidate = $_POST[\'candidat\']; 
=> 
$selected_candidate = $_POST[\'selectCandidate\']
顺便说一句,您正在使用;“准备”;以错误的方式。您没有保护自己免受sql注入的影响,请这样使用:

$wpdb->query( $wpdb->prepare("UPDATE pp_candidates SET candidate_approved = 1  WHERE candidate_ID = %d", $selected_candidate));