无法让 PHP 将表单数据处理到 MySQL 数据库中[重复]

Question

我正在尝试使用一些 PHP 将一些 HTML 表单数据处理到 MySQL 数据库中，但这是我第一次涉足 webdev，我想我已经不知所措了。表单被 POST 到 formSubmit.php 文件，该文件将它们转换为 sql 命令随后查询的变量。我已经尝试更改变量布局，但由于某种原因它仍然无法发送。

HTML 表单：

<form class="middleForm" name="pizzaGuest" action="formSubmit.php" method="POST">
<fieldset>
    <legend>Guest details</legend>
    First name:<br>
        <input type="text" name="firstName" required><br>
    Last name:<br>
        <input type="text" name="lastName" required><br>
    Email address:<br>
        <input type="email" name="email" required><br>
    Party date:<br>
        <input type="date" name="date" required><br>
    Diet:<br>
        <select name="diet">
            <option value="omnivore" selected>Omnivore</option>
            <option value="pescatarian">Pescatarian</option>
            <option value="vegetarian">Vegetarian</option>
            <option value="vegan">Vegan</option>
        </select><br>
    Dairy free?<br>
        <input type="checkbox" name="dairyFree"><br>
    Toppings:<br>
        <input type="text" name="toppings"><br>
    Allergies:<br>
        <input type="text" name="allergies"><br>
    <input type="submit" value="Submit">
</fieldset>
</form>

formSubmit.php:

<?php
        $servername = "localhost";
        $username = "partyForm";
        $password = "████████████";
        $dbname = "pizza";
        $conn = mysqli_connect($servername, $username, $password, $dbname);
        if (!$conn) {
            die("Connection failed: " . mysqli_connect_error());
        }

        $FirstName = $_POST["firstName"];
        $LastName = $_POST["lastName"];
        $Diet = $_POST["diet"];
        $Allergies = $_POST["allergies"];
        $Email = $_POST["email"];
        $DairyFree = $_POST["dairyFree"];

        $sql = "REPLACE INTO guests (FirstName, LastName, Diet, Allergies, Email, DairyFree) VALUES ($FirstName, $LastName, $Diet, $Allergies, $Email, $DairyFree);";

        mysql_query($sql)
        mysqli_close($conn);
    ?>

Answer 1

您可以尝试使用prepared statements 代替，因为它们可以防止 sql 注入并避免在您的 sql 省略时添加引号。

<?php

    $servername = "localhost";
    $username = "partyForm";
    $password = "xxx";
    $dbname = "pizza";

    $conn = new mysqli( $servername, $username, $password, $dbname );
    if( !$conn ) die("Connection failed");

    $sql = "replace into guests ( `firstname`, `lastname`, `diet`, `allergies`, `email`, `dairyfree` ) values (?,?,?,?,?,?);";
    $stmt=$conn->prepare($sql);
    $stmt->bind_param('ssssss',$_POST["firstName"], $_POST["lastName"], $_POST["diet"], $_POST["allergies"], $_POST["email"], $_POST["dairyFree"] );
    $stmt->execute();
    $stmt->close();
    $conn->close();
?>

Answer 2

为了获得最佳使用和舒适性，请检查 MySQL 的 PDO 驱动程序而不是 mysql。使用此方法，您可以轻松执行准备好的语句。

与此驱动程序的连接将是：

$dbh = null;

try {
    $dbh = new PDO('mysql:host=localhost;dbname=test', $user, $pass);
} catch (PDOException $e) {
    print "Erreur !: " . $e->getMessage() . "<br/>";
    die();
}

$stmt = $dbh->prepare("REPLACE INTO guests (FirstName, LastName, Diet, Allergies, Email, DairyFree) VALUES (:FirstName, :LastName, :Diet, :Allergies, :Email, :DairyFree);");
$stmt->bindParam(':FirstName', $FirstName);
$stmt->bindParam(':LastName', $LastName);
$stmt->bindParam(':Diet', $Diet);
$stmt->bindParam(':Allergies', $Allergies);
$stmt->bindParam(':Email', $Email);
$stmt->bindParam(':DairyFree', $DairyFree);
$stmt->execute();

// Close the connection at the end of your queries
$dbh->close();
$dbh = null;

这是保护您的代码并最大限度降低 SQL 注入风险的最佳方法。