传递数据库字段ID'；s根据字段值运行SQL - Passing Database Field ID's Run SQL Depending on the Fields Value

Passing Database Field ID's Run SQL Depending on the Fields Value

本文关键字：字段运行 SQL 数据库 ID | 更新日期: 2023-09-27

我正在尝试构建一个CMS，在那里我可以单击一个星形图标，它会更改我数据库中的art_featured值，所以如果art_featured值为0，我单击我的星形图标，我想将字段的值从0更改为1。我有点工作，但我不知道如何传递art_featured的值，通常我只会在我的span上传递id，但我已经在使用了，所以我可以告诉我需要更改哪篇文章，所以我如何将art_featured的值传递给我的SQL语句，这样我就可以运行if和else语句，然后根据art_featured的值运行某个SQL语句，

提前感谢您的帮助！

表

art_id  art_title  art_company    art_featured
1       lorem 1    lorem ipsum 1  1
2       lorem 2    lorem ipsum 2  0

HTML/PHP-

<section class="row">
    <?php
    $sql_categories = "SELECT art_title, art_company, art_id, art_featured FROM app_articles"; 
        if($result = query($sql_categories)){
            $list = array();
            while($data = mysqli_fetch_assoc($result)){
                array_push($list, $data);
            }
            foreach($list as $i => $row){ 
            ?>
                <div class="row">
                    <div class="column two"><p><?php echo $row['art_title']; ?></p></div>
                    <div class="column two"><p><?php echo $row['art_company']; ?></p></div>
                    <div class="column one"><span id="<?php echo $row['art_id']; ?>" class="icon-small star"></span></div>
                </div>
            <?php
            }
        }
        else {
            echo "FAIL";
        }
    ?>
    </section>

jQuery

        $(".star").click(function(){
        var art_id = $(this).attr('id');
        $.ajax({
        type: "POST",
        data: {art_id:art_id},
        url: "ajax-feature.php",
        success: function(data){
            if(data != false) {
            } 
            else {
            }  
        }
        });
    });

mySQL/PHP

    if(isset($_POST['art_id'])) {

    $sql_articles = "UPDATE `app_articles` SET `art_featured` = 1 WHERE `art_id` =".$_POST['art_id'];
    if(query($sql_articles)) {
        echo "YES";
    }
    else {
        echo "NO";
    }
}
else {
    echo "FAIL";
}

$sql_detail = "SELECT * FROM app_articles
WHERE art_id = " . $_POST['art_id'];
$sql_result = mysql_query($sql_detail);
if(mysql_num_rows($sql_result) > 0) { // the art_id supplied exists
    while($sR = mysql_fetch_array($sql_result)) {
        $art_title = $sR['art_title'];
        $art_company = $sR['art_company'];
        $art_featured = $sR['art_featured];
        // Do whatever you want with these variables
    }
} else { // the art_id supplied does not exist
}

将$_POST[‘art_id’]直接传递到SQL语句中是不安全的，因此您可能应该了解数据环境。但这应该可以。