将数组值插入mysql数据库

Question

变量是从前一页通过数组值发布的。 当我 print_r($values) 我得到这个数组的整个值，包括数组的数值，例如：array[0]、array[1] ..etc。 请有人告诉我我做错了什么。没有使用 implode 函数，因为值是通过会话变量从购物车页面传递的。

下面的第一部分代码：

<?php
    $current_url = base64_encode($url="http://".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']);
    if(isset($_SESSION["products"]))
    {
        $total = 0;
        echo '<form method="post" action="process.php">';
        echo '<ul>';
        $cart_items = 0;
        foreach ($_SESSION["products"] as $cart_itm)
        {
           $product_code = $cart_itm["code"];
           $results = $mysqli->query("SELECT Title,Description,Price FROM main_menu WHERE MenuID='$product_code' LIMIT 1");
           $obj = $results->fetch_object();

            echo '<li class="cart-itm">';
            echo '<span class="remove-itm"><a href="model/cart_update.php?removep='.$cart_itm["code"].'&return_url='.$current_url.'">&times;</a></span>';
            echo '<div class="p-price">'.$currency.$obj->Price.'</div>';
            echo '<div class="product-info">';
            echo '<h3>'.$obj->Title.' (Code :'.$product_code.')</h3> ';
            echo '<div class="p-qty">Qty : '.$cart_itm["qty"].'</div>';
            echo '<div>'.$obj->Description.'</div>';
            echo '</div>';
            echo '</li>';
            $subtotal = ($cart_itm["price"]*$cart_itm["qty"]);
            $total = ($total + $subtotal);

            echo '<input type="hidden" name="item_name['.$cart_items.']" value="'.$obj->Title.'" />';
            echo '<input type="hidden" name="item_code['.$cart_items.']" value="'.$product_code.'" />';
            echo '<input type="hidden" name="item_desc['.$cart_items.']" value="'.$obj->Description.'" />';
            echo '<input type="hidden" name="item_qty['.$cart_items.']" value="'.$cart_itm["qty"].'" />';
            $cart_items ++;

        }
        echo '</ul>';
        echo '<span class="check-out-txt">';
        echo '<strong>Total : '.$currency.$total.'</strong>  ';
                echo '<input name=\'submit\' type="submit" value="Complete Order" style=\"width:150px;background:#333;color:#ffcc33;height:30px;\" />';
        echo '</span>';
        echo '</form>';

    }else{
        echo 'No items added';
    }

    ?>

第二部分：

Answer 1

在给定函数中尝试$post 和table name 并使用mysql_real_escape_string() 来避免任何可能的SQL 注入

form.php

<?php

 include ('func_curd.php') ;
 if($_POST['hiddenfieldinfo']=='ok')
    { 
        $r=insert_your_table_name($_POST); 
        if($r==true) 
            {  

                header('Location:'.get_full_url()); /* to redirect the form to the same page after successful submission*/          
            }
    } 
?>

func_curd.php

<?php        
function insert_your_table_name($post)
{        
 unset($post['hiddenfieldinfo']); 
   /* Here I am unsetting this value as it is hidden field 
in the form , which I am using as form submission check and 
is not in database column, apart form auto-increment in database 
that is id, you have to maek sure all the post value and column
 name matches with case-sensitivities  */
 $u = insert('your_table_name', $post);

                            $r=is_numeric($u)? true : false ;

                            return $r;

}


        function insert($table, $values){

                $query="INSERT INTO `$table` ";

                $column='(';

                $val=' (';

                $count=count($values);

                $mk=1;

                foreach ($values as $key=>$value)

                {

                    $value=mysql_real_escape_string($value);

                    if ($mk==$count)

                    {

                        $column .= '`'.$key.'`';

                        $val .= "'".$value."'";

                    }

                    else

                    {

                        $column .= '`'.$key.'`, ';

                        $val .= "'".$value."', ";

                    }

                    $mk++;

                }

                $column .=') ';

                $val .=')';

                $query=$query.$column.'VALUES'.$val;

                $Q=mysql_query($query);

                if(mysql_error())

                {

                    return print(mysql_error());

                }

                else

                {

                    $insert_id=mysql_insert_id();

                    return $insert_id;

                }

            }

        ?>

Answer 2

试试这个：

<?php
require_once('config/connect.php');

$item_name  = strip_tags($_POST['item_name']);  
$item_code  = strip_tags($_POST['item_code']);
$item_desc  = strip_tags($_POST['item_desc']);
$item_qty  = strip_tags($_POST['qty']);
$price = strip_tags($_POST['price']);

 $fields = "item_name, item_code, item_desc, price,qty";

 $query = "INSERT INTO `x` SET ";
 $i = 0;
 foreach( $fields as $fieldname )
 {
        if ( $i > 0 )
            $query .= ", ";
        $val = strip_tags($_POST[$fieldname]);  
        $query .= "`" . $fieldname . "` = '" . $val . "'"

        $i++
 }

 $query_result = mysql_query($query);
 echo" Record saved";
 print_r ( $query );
?>

您的代码中存在某些语法错误，例如未关闭的 foreach 等。我确实跳过了。

作为建议：这样的代码向 Internet 上的每个人公开数据库结构 - 表单字段名称 = 数据库列名称。这通常是一个坏主意。 更好的是一种映射表：

 $fields = array (
      'myFormName' => 'mySqlName',
      ....


 foreach( $fields as $fieldname => $sqlame)
 {
        if ( $i > 0 )
            $query .= ", ";
        $val = strip_tags($_POST[$fieldname]); 
        $query .= "`" . $sqlname. "` = '" . $val . "'"
        ....

这也将使表单更加独立于底层数据结构。