php 警告：mysqli_real_escape_string() 期望参数 1 是 mysqli，给出的字符串

Warning: mysqli_real_escape_string() expects parameter 1 to be mysqli, string given

提问by Lec

I have a secured area of my site where I can add/update/delete database entries. I am trying to update the script from mysql to mysqli. Everything works except for the "update" part. When I fill in the new information and click "update", it gives me this error:

我的站点有一个安全区域，我可以在其中添加/更新/删除数据库条目。我正在尝试将脚本从 mysql 更新到 mysqli。除了“更新”部分，一切正常。当我填写新信息并单击“更新”时，它给了我这个错误：

Warning: mysqli_real_escape_string() expects parameter 1 to be mysqli, string given in /home3/tarb89/public_html/aususrpg.net/charbase/updated.php on line 19

警告：mysqli_real_escape_string() 期望参数 1 是 mysqli，在第 19 行的 /home3/tarb89/public_html/aususrpg.net/charbase/updated.php 中给出的字符串

I'm not sure what is wrong here; I'm a complete newbie, so my apologies.

我不确定这里有什么问题；我是一个完全的新手，所以我很抱歉。

Here is my update.php code:

这是我的 update.php 代码：

<?php
    // Create connection
$con=mysqli_connect("xxx","xxx","xxx","xxx");

// Check connection
if (mysqli_connect_errno())
  {
  echo "Failed to connect to MySQL: " . mysqli_connect_error();
  }


$id = $_GET['id'];

$result = mysqli_query($con,"SELECT * FROM characters WHERE id = '$id'");
$my_array = array($c_z);
extract($my_array);

?>

<form id="FormName" action="../charbase/updated.php" method="post" name="FormName">
<table width="448" border="0" cellspacing="2" cellpadding="0">

<tr>
<td width="150" align="right"><label for="name">Name: </label></td>
<td><input name="name" maxlength="255" type="text" value="<?php echo stripslashes($name) ?>"></td>
</tr>

<tr>
<td colspan="2" align="center">
<input name="" type="submit" value="Update">
<input name="id" type="hidden" value="<?php echo $id ?>">
</td>
</tr>

</table>
</form>

The other issue I have with the update.php page is when it displays the table, the inputs should display the information already listed in the database; currently, it shows the name field but the input section is empty. It should display the name data already in the database (then I can replace it with whatever I want it to update as.)

update.php 页面的另一个问题是当它显示表格时，输入应该显示数据库中已经列出的信息；目前，它显示名称字段，但输入部分为空。它应该显示数据库中已有的名称数据（然后我可以用我想要它更新的任何内容替换它。）

Here is the updated.php code:

这是updated.php 代码：

<?php
// Create connection
$con=mysqli_connect("xxx","xxx","xxx","xxx");

// Check connection
if (mysqli_connect_errno())
  {
  echo "Failed to connect to MySQL: " . mysqli_connect_error();
  }

$id = $_POST['id'];

$name = mysqli_real_escape_string(trim($_POST["name"]), $con);

$rsUpdate = mysqli_query($con,"UPDATE characters SET name='$name'
WHERE id='$id'");

if($rsUpdate) { echo "Successfully updated"; } else { die('Invalid query: '.mysql_error()); }
?>

<a href="index.php">Back to index</a>

Any help would be greatly appreciated. This thing is driving me bonkers.

任何帮助将不胜感激。这件事让我发疯。

---

---

Different issue: see above update.php code.

不同的问题：请参阅上面的 update.php 代码。

When I click on a link next to a database entry, called "Update Information", it takes me to update.php?id=charactersid

当我单击数据库条目旁边的链接时，称为“更新信息”，它会将我带到 update.php?id=charactersid

Currently, it displays an empty input form. I can input information and hit "update" and it WILL update correctly.

目前，它显示一个空的输入表单。我可以输入信息并点击“更新”，它会正确更新。

However, when I am taken to the update.php page, I want it to display the input form except the values should all equal what is already in the database.

但是，当我进入 update.php 页面时，我希望它显示输入表单，但值应该全部等于数据库中已有的值。

For example:

例如：

What it currently shows:

它目前显示的内容：

Name: [empty input box]

名称：【空输入框】

What I want it to show:

我希望它显示的内容：

Name: [current name listed in the database]

名称：[数据库中列出的当前名称]

So the value of the input should be the information for that character; so that when I want to update, I can see what is already listed as information for that character and change/delete/add whatever else I need to.

所以输入的值应该是那个字符的信息；这样当我想更新时，我可以看到已经列为该角色信息的内容，并更改/删除/添加我需要的任何其他内容。

Does that make more sense?

这样做更有意义吗？

回答by Prix

You're using it the opposite way:

您以相反的方式使用它：

string mysqli_real_escape_string ( mysqli $link , string $escapestr )

So it should be:

所以应该是：

$name = mysqli_real_escape_string($con, trim($_POST["name"]));

Source: http://php.net/mysqli_real_escape_string

来源：http: //php.net/mysqli_real_escape_string

Since you're using MySQLi I would suggest you to just jump into prepared statements rather than real_escape, like this:

由于您使用的是 MySQLi，我建议您直接使用准备好的语句而不是 real_escape，如下所示：

<?php 
// Your database info 
$db_host = 'host'; 
$db_user = 'user'; 
$db_pass = 'pass'; 
$db_name = 'database';

// POST data
$id = $_POST['id'];
$name = trim($_POST["name"]);

$con = mysqli_connect($db_host, $db_user, $db_pass, $db_name);
if ($con->connect_error)
{
    die('Connect Error (' . mysqli_connect_errno() . ') '. mysqli_connect_error());
}

$sql = "UPDATE characters SET name = ? WHERE id = ?"; 
if (!$result = $con->prepare($sql))
{
    die('Query failed: (' . $con->errno . ') ' . $con->error);
}

if (!$result->bind_param('si', $name, $id))
{
    die('Binding parameters failed: (' . $result->errno . ') ' . $result->error);
}

if (!$result->execute())
{
    die('Execute failed: (' . $result->errno . ') ' . $result->error);
}

$result->close();
$con->close();
echo "Successfully updated";
?>
<a href="index.php">Back to index</a>

To select the character name:

要选择角色名称：

<?php 
// Your database info 
$db_host = 'host'; 
$db_user = 'user'; 
$db_pass = 'pass'; 
$db_name = 'database';

// POST data
$id = $_POST['id'];

$con = mysqli_connect($db_host, $db_user, $db_pass, $db_name);
if ($con->connect_error)
{
    die('Connect Error (' . mysqli_connect_errno() . ') '. mysqli_connect_error());
}

$sql = "SELECT name FROM characters WHERE id = ?";
if (!$result = $con->prepare($sql))
{
    die('Query failed: (' . $con->errno . ') ' . $con->error);
}

if (!$result->bind_param('i', $id))
{
    die('Binding parameters failed: (' . $result->errno . ') ' . $result->error);
}

if (!$result->execute())
{
    die('Execute failed: (' . $result->errno . ') ' . $result->error);
}

$result->store_result();
if ($result->num_rows == 0)
{
    die('No character found...');
}

$result->bind_result($name);
$result->fetch();
$result->close();
$con->close();
echo $name;